gh-issue-resolver
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core workflow (Step 1) involves fetching and parsing an 'agreed plan' from a GitHub issue comment. An attacker with the ability to comment on the target repository could inject malicious instructions or a deceptive implementation plan by spoofing the required HTML marker (
<!-- gh-issue-planner:agreed-plan -->). This is a documented attack surface where external, untrusted data directly influences the agent's code implementation and verification behavior. - Ingestion points: The skill reads content from the
commentsarray of a GitHub issue via thegh issue viewcommand (SKILL.md, Step 1). - Boundary markers: It relies on the presence of an HTML comment marker
<!-- gh-issue-planner:agreed-plan -->. While these markers provide structure, they do not provide security as they can be easily included in any user-generated comment. - Capability inventory: The skill has significant capabilities, including modifying the local filesystem (Step 3), executing arbitrary shell commands for testing (Step 4), and performing network operations via the GitHub CLI (
git push,gh pr create). - Sanitization: There is no mention of sanitizing or validating the contents of the extracted plan before the agent begins applying changes to the codebase.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands, including
gitandghCLI tools. Most notably, Step 4 involves running 'relevant tests,' which typically means executing scripts within the repository's environment. If the implementation step is compromised via indirect injection, these test executions could be leveraged to run malicious code.
Audit Metadata