triage
Warn
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md direct the agent to check out and execute code from external pull requests ("run the relevant tests or commands") to verify claims. As external pull requests are untrusted, this creates a vector for executing malicious code if an attacker includes harmful commands in the PR's tests or scripts.
- [COMMAND_EXECUTION]: The agent is authorized to run arbitrary tests and commands based on external pull request content, providing a broad execution surface.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external issues and PRs which are untrusted ingestion points. It lacks sanitization or boundary markers to prevent the agent from following instructions embedded in that data. The capability inventory includes executing shell commands and modifying repository state.
- [INDIRECT_PROMPT_INJECTION]: Ingestion points: GitHub issue tracker (SKILL.md). Boundary markers: Absent. Capability inventory: Shell command execution for tests/verification, codebase exploration, writing comments, and closing issues (SKILL.md). Sanitization: None.
Audit Metadata