epic-dev
Warn
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs an external dependency using the command
gh extension install agbiotech/gh-sub-issue. This repository belongs to an account not associated with the skill author. - [COMMAND_EXECUTION]: The workflow involves executing sequences of shell commands, including
git worktree,git push, andgh pr create, which are driven by state stored in.claude/epic.local.mdand user-provided inputs. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes unvalidated user-provided text to populate GitHub issue and pull request content.
- Ingestion points: User-provided epic descriptions and the contents of the local state file
.claude/epic.local.md. - Boundary markers: No delimiters or warnings are included to isolate untrusted data from instructions.
- Capability inventory: Access to GitHub issue creation, sub-issue management, and pull request lifecycle (creation and merging).
- Sanitization: No explicit sanitization or input validation mechanisms are defined for the text passed to the GitHub CLI.
Audit Metadata