triage
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core workflow of processing untrusted external data.
- Ingestion points: In SKILL.md, the agent is instructed to read the entire issue or PR, including the body, comments, and author information.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands within the ingested text are provided.
- Capability inventory: According to SKILL.md, the agent can execute shell commands ("run the relevant tests or commands"), read and write files (ADRs, project documentation, and the
.out-of-scope/directory), and post comments or change labels on the issue tracker. - Sanitization: There is no evidence of content sanitization or validation before processing.
- [COMMAND_EXECUTION]: The skill instructions in SKILL.md tell the agent to "check it out, run the relevant tests or commands" to verify a PR. This involves the execution of arbitrary code and scripts defined by external contributors in the PR's diff and test suite, which could be used to execute malicious commands if the execution environment is not properly sandboxed.
Audit Metadata