triage
Warn
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to "check it out, run the relevant tests or commands" when verifying external pull requests (SKILL.md, Step 3). This behavior enables the execution of untrusted code provided by third-party contributors.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the issue tracker that could influence agent behavior.
- Ingestion points: Untrusted data is ingested from issue bodies, comments, and pull request diffs (SKILL.md, Step 1 and 3).
- Boundary markers: No explicit markers are defined to isolate untrusted external data from the skill's instructions.
- Capability inventory: The agent has the ability to execute shell commands for verification (Step 3) and perform repository actions like posting comments and closing issues (Step 5).
- Sanitization: The instructions do not specify any validation or sanitization of the external input or code before it is processed or executed.
- [COMMAND_EXECUTION]: The agent is directed to reproduce bugs based on steps provided by external reporters (SKILL.md, Step 3), which could involve executing malicious command sequences on the host system.
Audit Metadata