triage
Fail
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: HIGHINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and acting upon untrusted data from an external issue tracker.\n
- Ingestion points:
SKILL.md(Step 1: Gather context) directs the agent to read the full body, comments, and code diffs of issues and pull requests provided by external reporters.\n - Boundary markers: The instructions lack specific boundary markers or explicit guidance for the agent to ignore or sanitize embedded instructions within the external content.\n
- Capability inventory: The skill utilizes tools to execute shell commands (for reproduction and tests), write to the local filesystem (updating
.out-of-scope/files), and perform network operations via the issue tracker's API.\n - Sanitization: There is no evidence of sanitization or filtering of the ingested external data before it is processed or acted upon by the agent.\n- [COMMAND_EXECUTION]: The skill instructs the agent to perform actions based on untrusted external input.\n
- Evidence: In
SKILL.md(Step 3: Verify the claim), the agent is told to "reproduce it from the reporter's steps" for bug reports and to "run the relevant tests or commands" associated with external pull requests. This establishes a direct path for executing arbitrary logic or commands provided by third parties.\n- [DYNAMIC_EXECUTION]: The instructions facilitate the execution of logic derived from external sources.\n - Evidence: The requirement to confirm that a "diff does what it claims" by running the PR's tests or commands involves the dynamic execution of code provided by an external author within the agent's environment.
Recommendations
- AI detected serious security threats
Audit Metadata