qa-feature
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing scripts found in the workspace's package.json file. This allows for the execution of arbitrary shell commands if the repository configuration is malicious.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted data from GitHub and Notion. 1. Ingestion points: Pull request titles, descriptions, comments, and diffs, as well as Notion ticket requirements. 2. Boundary markers: The instructions lack delimiters or directions to ignore instructions found within the external data. 3. Capability inventory: Access to GitHub and Notion via MCP, file system read access, and command execution. 4. Sanitization: No sanitization is specified for the ingested content.
- [DATA_EXFILTRATION]: The skill reads from private GitHub and Notion sources, which could lead to exposure of sensitive project information if the agent's instructions are subverted.
Audit Metadata