blueprint

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: During the preflight stage, the skill executes a shell script located at "${CLAUDE_PLUGIN_ROOT}/scripts/preflight.sh" to verify that the GitHub CLI is authenticated and a remote is present. This is a local execution of a vendor-provided utility.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it fetches and processes user-generated comments from GitHub issues to drive automated design and plan reviews.\n
  • Ingestion points: Untrusted content is ingested from GitHub issue comments via gh issue view --comments in plan-issue-reviewer-prompt.md and spec-issue-reviewer-prompt.md.\n
  • Boundary markers: The reviewer prompts do not use delimiters or negative constraints to prevent the subagent from following instructions found within the comments.\n
  • Capability inventory: The subagent's evaluation (Approve vs Issues Found) determines the workflow progression for the primary agent.\n
  • Sanitization: External comment data is interpolated directly into the subagent's prompt without prior filtering or sanitization.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 02:28 AM
Security Audit — agent-trust-hub — blueprint