github-issue-triage
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue titles and bodies which are processed by subagents to determine if issues are outdated.
- Ingestion points: GitHub issue data is fetched via
fetch-issues.shand stored in/tmp/issues_full.jsonor/tmp/issues_annotated.json, which are then provided to subagents as part of their context. - Boundary markers: The prompt template provided in
SKILL.mdfor dispatching parallel agents lacks delimiters (e.g., XML tags or clear separators) and does not include specific instructions to ignore instructions embedded within the untrusted issue text. - Capability inventory: The skill provides scripts (
explore-issue.sh,close-issues.sh) that execute search commands (rg,git log) and perform repository-modifying actions (gh issue comment,gh issue close) based on the subagent's analysis of this untrusted data. - Sanitization: While the issue title is processed to extract alphanumeric keywords for automated searching, the full issue body passed to the agent remains unsanitized, creating a risk that malicious issue content could influence the agent's verdict or behavior.
Audit Metadata