afkkit
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted data from external sources and using it to drive autonomous actions. The orchestrator reads GitHub issue descriptions which are then used to orient subagents during the implementation and verification phases. Maliciously crafted issue content could potentially influence the agent's behavior or output if not properly delimited or sanitized.
- Ingestion points: The skill fetches external data through the
gh issue viewcommand in theStart the issueandSpec gatesteps (SKILL.md). - Boundary markers: The instructions do not explicitly mandate the use of robust delimiters (e.g., XML tags) or safety warnings when passing issue content to subagents.
- Capability inventory: The skill and its subagents have broad capabilities including shell execution via
Bash, file system modification through implementation kits, and network operations via the GitHub CLI. - Sanitization: There is no documented mechanism for sanitizing or validating the input from GitHub issues before it is processed by the AI models.
Audit Metadata