wizard
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from repository files to generate its output.
- Ingestion points: The skill reads
.env,.env.example,README,docker-compose*, and GitHub workflow files (.github/workflows/*) to identify configuration values. - Boundary markers: No specific delimiters or warnings are used to differentiate repository content from the agent's instructions during the scoping phase.
- Capability inventory: The generated wizard script can write to the local filesystem (
.env), set repository secrets and variables using the GitHub CLI (gh), and open arbitrary URLs in the system's web browser. - Sanitization: The skill does not perform sanitization or validation on the content retrieved from the repository files before using it to author the bash script stages.
Audit Metadata