review-design
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using unvalidated user-supplied parameters, including URLs, PR numbers, and commit SHAs. This creates a potential command injection surface if the executing environment does not properly sanitize these arguments.
- Evidence: Use of
<pr_number>,<commit_sha>, and<url>variables in shell commands forgh,git, andagent-browsertools inSKILL.md(Phase 0 and Phase 3). - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes content from external, potentially untrusted URLs through browser snapshots and accessibility trees.
- Ingestion points: Live URL capture via
agent-browser(SKILL.md, Phase 3). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the captured external content.
- Capability inventory: The agent has access to shell tools (
git,gh,agent-browser), file reading capabilities, and the ability to spawn sub-agents. - Sanitization: No explicit sanitization or filtering of external content is described before the data is processed by sub-agents.
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of an external CLI tool,
agent-browser, from the npm registry to enable live auditing capabilities. - Evidence: Installation check and instructions in
SKILL.md(Phase 1).
Audit Metadata