triage
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in
SKILL.md(Step 3: Verify the claim) direct the agent to 'check out, run the relevant tests or commands' from external pull requests. This represents a high-risk execution vector, as tests or build scripts in a malicious PR could execute arbitrary code on the agent's environment. - [INDIRECT_PROMPT_INJECTION]: The skill lacks boundary markers or sanitization when processing untrusted external data.
- Ingestion points:
SKILL.md(Step 1: Gather context) reads the full issue or PR body, comments, and diff contents from external sources. - Boundary markers: None identified. There are no instructions to the agent to treat this external content as data rather than instructions.
- Capability inventory: The skill allows writing to the repository (
.out-of-scope/directory,CONTEXT.md, and ADR files), posting comments to GitHub, and executing shell commands (Step 3). - Sanitization: None identified. The skill interpolates external content directly into the triage workflow.
- [COMMAND_EXECUTION]: The skill facilitates the execution of potentially unsafe commands by instructing the agent to run 'relevant tests or commands' found within the context of external pull requests, which are attacker-controlled surfaces.
Audit Metadata