sweep
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that could contain malicious instructions.
- Ingestion points: Reads production signals (Sentry, PostHog, logs) and PR content via gh pr view.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are defined for these inputs.
- Capability inventory: Can modify code, run tests, manage git worktrees, and open PRs.
- Sanitization: Focuses on redacting secrets but lacks mechanisms to prevent instruction injection.
- [COMMAND_EXECUTION]: The skill executes local commands to facilitate the development cycle.
- Evidence: Runs a local bash script (known-work.sh) and utilizes git and gh for branch and PR operations.
- [DATA_EXFILTRATION]: The skill fetches data from external telemetry services.
- Evidence: Accesses production signals and logs from Sentry and PostHog to provide evidence for identified issues.
Audit Metadata