triage
Warn
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to 'run the relevant tests or commands' from external pull requests to verify their validity. This involves executing code authored by third parties, which may be malicious.
- [PROMPT_INJECTION]: The skill processes untrusted data from an external issue tracker, including issue bodies, comments, and PR diffs, without explicit boundary markers or sanitization logic, creating a surface for indirect prompt injection.
- Ingestion points: Issue bodies, PR bodies, comments, and file diffs in SKILL.md.
- Boundary markers: None present; the skill is instructed to parse and interpret all parts of the issue/PR context.
- Capability inventory: The skill can execute shell commands for testing in SKILL.md, write markdown files to the repository, and post comments to the issue tracker.
- Sanitization: No sanitization or input validation is specified for the ingested external content.
Audit Metadata