issue-flow
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill extensively uses shell commands via the GitHub CLI (
gh) andgit. To mitigate command injection risks, it provides specific instructions to sanitize user-influenced data, such as slugifying issue titles for branch names (lowercase, special character replacement, and truncation). It also utilizes secure shell patterns like HEREDOCs to handle multi-line string interpolation safely. - [INDIRECT_PROMPT_INJECTION]: The workflow ingests external data from GitHub Issues (titles, bodies, and comments) which is then used to generate technical plans and coordinate subagents. While this presents an attack surface where a malicious issue could attempt to influence the agent's behavior, the skill requires explicit human confirmation of the technical plan (Phase 2d) and the final pull request (Phase 4d) before proceeding, effectively mitigating the risk of unauthorized actions.
- Ingestion points: GitHub Issue details fetched in Phase 0 via
gh issue view. - Boundary markers: The skill uses HTML comment markers like
<!-- issue-flow-plan -->to identify its own generated content, but does not explicitly define delimiters for raw issue body content during ingestion. - Capability inventory: The skill has capabilities for file system access (via git worktrees), shell command execution (git/gh), and spawning subagents for code exploration and implementation.
- Sanitization: Implements slugification for branch names and HEREDOC structures for remote command inputs to GitHub.
Audit Metadata