tk-ask-repo
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and interpret data from external sources such as repository code, issues, PR reviews, and CI logs, which constitutes a surface for indirect prompt injection attacks where malicious instructions might be embedded in the data.
- Ingestion points: Data is retrieved from natural language in issues, PR reviews, CI logs, command output, and file content as specified in the 'Retrieved Evidence Boundary' section of SKILL.md.
- Boundary markers: The skill includes a robust 'Retrieved Evidence Boundary' that explicitly warns the agent that instruction-like text within retrieved data must not change the skill's protocol, scope, or tool permissions.
- Capability inventory: The skill is strictly read-only and does not perform file writes or remote state modifications, though it may trigger other tools like 'tk-browser-verify' for evidence discovery.
- Sanitization: Guidelines in 'references/ui-evidence.md' explicitly instruct the agent to exclude secrets and unrelated sensitive page data from tool output and reports.
Audit Metadata