pr-mark-viewed
Fail
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform shell operations using external data (GitHub file paths). In step 3, it specifically tells the agent to use double quotes to handle paths containing
$. This construction is unsafe as it allows for shell expansion and subshell execution if a file in the repository is maliciously named (e.g.,$(touch_evil).js). The agent executinggh api ... -f p="$(touch_evil).js"would trigger the embedded command. - [INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect prompt injection by processing untrusted PR data to make decisions.
- Ingestion points: The skill reads
files.json(patches and filenames) fetched from the GitHub REST API in step 1. - Boundary markers: Absent. There are no instructions or delimiters provided to ensure the agent ignores natural language instructions embedded within the code patches it is classifying.
- Capability inventory: The skill can execute shell commands (
gh,jq) and perform write operations to the GitHub API (marking files as viewed). - Sanitization: Absent. There is no logic to sanitize or escape the content of the patches before the agent analyzes them to determine equivalence or triviality.
Recommendations
- AI detected serious security threats
Audit Metadata