triage
Fail
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to verify external pull requests by checking out the code and running relevant tests or commands. Since external PRs are untrusted, this creates a vector for executing arbitrary, potentially malicious code provided by an external contributor.
- [COMMAND_EXECUTION]: The instruction to run tests and shell commands based on the contents of an untrusted PR involves executing high-risk commands that could be manipulated by an attacker to compromise the environment.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes untrusted data from issue tracker bodies and comments. 1. Ingestion points: Issue and PR descriptions and comments as described in SKILL.md. 2. Boundary markers: No delimiters or specific instructions to ignore embedded instructions are used. 3. Capability inventory: The agent can explore the codebase, read files, execute commands (tests), and post comments back to the tracker. 4. Sanitization: No sanitization or validation of the external content is performed before the agent acts on the information.
Recommendations
- AI detected serious security threats
Audit Metadata