frontend-ops-expert
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface by ingesting and processing data from external files and tool outputs without explicit sanitization.
- Ingestion points: In SKILL.md, the procedure reads data from ci.json, deps.json, and triage.json, and processes output from the GitHub CLI.
- Boundary markers: The skill does not define specific delimiters or include instructions for the agent to ignore potentially malicious content within the ingested reports.
- Capability inventory: The agent has permissions to read files, write reports to the local file system, and execute shell commands using the GitHub CLI.
- Sanitization: There is no evidence of filtering or validation for the data ingested from the repository reports or PR metadata.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific shell commands to gather repository data.
- Evidence: Step 3 in SKILL.md uses the command
gh pr list --state open --author dependabot --limit 50. The command is well-defined and scoped to a specific author, which follows the principle of least privilege for automated tasks.
Audit Metadata