eval-iterate
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes data from external sources that could contain malicious instructions.\n
- Ingestion points: The skill ingests untrusted data from user arguments, test failure logs (BASELINE_FAILURE), and repository files like test definitions and code under test.\n
- Boundary markers: The agent instructions lack clear boundary markers or instructions to ignore potential injections within the captured tool outputs.\n
- Capability inventory: The skill possesses extensive capabilities, including reading and writing files, executing shell commands (git, node, gh), and interacting with remote repositories via the GitHub CLI.\n
- Sanitization: There is no evidence of content sanitization or validation of the external inputs before they are used for reasoning or file modification.\n- [COMMAND_EXECUTION]: The skill dynamically identifies and executes shell commands extracted from the repository's configuration files (e.g., package.json and GitHub Actions workflows). While necessary for running evaluations, this involves executing commands defined in external files.\n- [EXTERNAL_DOWNLOADS]: The skill uses the GitHub CLI (gh) to interact with github.com to fetch pull request metadata and status checks. These operations target a well-known service and are consistent with the skill's documented purpose.
Audit Metadata