modelopt-release-cherry-pick
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from merged Pull Requests and NVBug reports.
- Ingestion points: PR titles, bodies, labels, and NVBug comments are fetched and reviewed by the agent in Step 2 and Step 3.
- Boundary markers: Absent; there are no explicit delimiters or instructions for the agent to ignore potentially malicious embedded prompts within the PR or bug report metadata.
- Capability inventory: The skill possesses significant capabilities including executing shell commands via
gitandgh, pushing code to remote branches, and creating/labeling pull requests. - Sanitization: Absent; the agent interprets raw natural language content to classify changes as bug fixes, which is a surface for prompt injection.
- [COMMAND_EXECUTION]: The skill constructs shell commands using input provided by the user.
- In Step 1 and Step 2, the agent accepts a release version string from the user and interpolates it into multiple shell commands (e.g.,
git fetch origin "release/$VERSION",gh search prs --json ... "-label:cherry-pick-$VERSION"). If the user provides a maliciously crafted version string, it could lead to command injection, though this is a standard pattern for dev-tooling skills.
Audit Metadata