to-spec
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository and conversation history, creating a surface for instructions embedded in those sources to influence the agent.
- Ingestion points: Processes codebase content and conversation context as defined in SKILL.md.
- Boundary markers: Lacks clear delimiters or instructions to ignore potential commands within the repository data.
- Capability inventory: Includes the ability to explore the filesystem and interact with external issue trackers (e.g., via GitHub CLI).
- Sanitization: No specified mechanisms for filtering or validating the repository content before synthesis.
- [COMMAND_EXECUTION]: The skill implicitly uses system commands for repository discovery and issue submission.
- Evidence: Instructions in SKILL.md to 'Explore the repo', 'resolve the publication target... from the Git remote', and 'publish it to the project issue tracker'.
Audit Metadata