blueprint
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: During the preflight stage, the skill executes a shell script located at "${CLAUDE_PLUGIN_ROOT}/scripts/preflight.sh" to verify that the GitHub CLI is authenticated and a remote is present. This is a local execution of a vendor-provided utility.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it fetches and processes user-generated comments from GitHub issues to drive automated design and plan reviews.\n
- Ingestion points: Untrusted content is ingested from GitHub issue comments via
gh issue view --commentsinplan-issue-reviewer-prompt.mdandspec-issue-reviewer-prompt.md.\n - Boundary markers: The reviewer prompts do not use delimiters or negative constraints to prevent the subagent from following instructions found within the comments.\n
- Capability inventory: The subagent's evaluation (Approve vs Issues Found) determines the workflow progression for the primary agent.\n
- Sanitization: External comment data is interpolated directly into the subagent's prompt without prior filtering or sanitization.
Audit Metadata