fix-github-issues
Fail
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: HIGHINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions explicitly direct the agent to "land" fixes by pushing them to the repository's default branch without asking for user confirmation. This high-autonomy behavior bypasses human-in-the-loop review for codebase modifications and presents a severe risk to repository integrity, as the agent may push changes influenced by malicious external input.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue bodies and comments, creating a vulnerability surface for indirect instructions.
- Ingestion points:
SKILL.md(Step 2) instructs the agent to read the body and every comment of GitHub issues to classify findings. - Boundary markers: Absent. There are no instructions to use delimiters or warnings to ignore instructions embedded within the issue content.
- Capability inventory: The agent has extensive capabilities, including modifying the codebase, running shell commands, executing tests, and pushing to remote repositories.
- Sanitization: Absent. The skill does not implement any sanitization or validation of the external issue text before it is analyzed for "legit" findings.
- [DYNAMIC_EXECUTION]: The skill executes the repository's configured test suite after applying fixes based on findings from GitHub issues. If an attacker-controlled issue comment tricks the agent into applying a malicious "fix," the subsequent test execution provides a path for executing arbitrary code within the project's environment.
Recommendations
- AI detected serious security threats
Audit Metadata