contributions-scout
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external GitHub repositories, which presents a surface for indirect prompt injection.
- Ingestion points: Processes repository documentation (AGENTS.md, CONTRIBUTING.md) and issue tracker content (comments, issue descriptions) in Step 2.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing this external content.
- Capability inventory: The agent has access to
Bash(gh:*)andBash(multica:*)which allow it to post comments and interact with issue trackers. - Sanitization: No explicit sanitization or filtering of the ingested GitHub content is described before the agent performs its analysis or posts its deliverable.
- [EXTERNAL_DOWNLOADS]: The skill references an external repository at
https://github.com/mmontes11/contributionsto verify scoring rubrics during the feasibility evaluation phase. - [COMMAND_EXECUTION]: The skill utilizes command-line interfaces for GitHub operations and project management.
- Evidence: Employs
ghfor repository metadata and issue searching, andmulticafor posting deliverable comments and updating sub-issue statuses.
Audit Metadata