ce-dogfood-beta
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes git diffs from potentially untrusted branches or Pull Requests without using boundary markers or sanitization. 1. Ingestion points: The skill reads the full diff against main via 'git diff main...HEAD' to understand changes. 2. Boundary markers: No delimiters or 'ignore embedded instructions' warnings are implemented for processing the diff content. 3. Capability inventory: The skill has high-privilege capabilities including writing to the file system (auto-fixing code), executing shell commands, and committing code changes. 4. Sanitization: No sanitization or validation of the diff content is performed before processing.
- [COMMAND_EXECUTION]: The skill relies on several command-line tools to perform its core functions. Evidence: Uses 'git' for diffing and committing fixes, 'gh' for GitHub PR management, and 'agent-browser' for web automation. It also processes user-supplied arguments for branch names and PR numbers which could present a command injection risk if handled unsafely by the agent.
- [EXTERNAL_DOWNLOADS]: The skill references an external dependency installation process. Evidence: It directs the user to run the 'ce-setup' skill to install the 'agent-browser' binary if it is not found on the local system.
Audit Metadata