triage
Warn
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md under Step 3: Verify the claim direct the agent to check out external pull requests and run the relevant tests or commands. Since pull requests from external contributors are untrusted code, this creates a direct path for remote code execution if the test suite or project commands are maliciously modified.
- [COMMAND_EXECUTION]: The agent is prompted to execute arbitrary shell commands or test suites provided within the context of a pull request, which can be manipulated by an attacker to gain unauthorized access or perform malicious actions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from issue trackers without adequate safeguards to prevent malicious instructions from being obeyed.
- Ingestion points: The agent reads the full body, comments, and metadata of issues and pull requests in SKILL.md during the Gather context phase.
- Boundary markers: There are no instructions to the agent to treat external content as data rather than instructions, nor are there delimiters used to separate untrusted user input from the skill's logic.
- Capability inventory: The skill has access to the file system (reading/writing .out-of-scope/ files and updating ADRs), issue tracker tools (commenting, closing, labeling), and command execution (running tests).
- Sanitization: No sanitization, filtering, or escaping of external input is performed before the agent processes and acts upon the content.
Audit Metadata