triage
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from issue bodies, reporter comments, and reproduction steps.
- Ingestion points: The agent reads the full issue content, including comments and reporter-provided steps (SKILL.md, Step 1 and 3).
- Boundary markers: The instructions do not define specific delimiters or guardrails to prevent the agent from following malicious instructions embedded within issue reports.
- Capability inventory: The agent has the authority to execute shell commands, run tests, write to the filesystem (.out-of-scope/ files), and perform GitHub actions like commenting or closing issues (SKILL.md, Step 3 and 5).
- Sanitization: There are no requirements for the agent to sanitize or validate the issue content before using it to drive command execution during reproduction.
- [COMMAND_EXECUTION]: The skill explicitly permits the agent to run tests and shell commands based on the reporter's provided steps to reproduce bugs (SKILL.md, Step 3). This is an intended feature for a developer-centric triage tool but represents an execution surface that could be targeted by malicious issue content.
Audit Metadata