done
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources during its execution flow. Specifically, Step 2 instructs the agent to read 'repository instructions' and Step 4 involves inspecting 'open issues' from a git forge (GitHub/GitLab). If these external sources contain malicious instructions, they could attempt to influence the agent's behavior during the privileged commit or merge process.
- Ingestion points: Step 2 (repository instructions) and Step 4 (forge issues via CLI/API).
- Boundary markers: The skill does not explicitly define markers to separate these external inputs from the system instructions, though it does establish a 'closure contract' in Step 1.
- Capability inventory: The skill can perform git commits, pushes, PR creation, issue mutation, and merging.
- Sanitization: No explicit sanitization or filtering of the external issue text is defined.
- [COMMAND_EXECUTION]: The skill is designed to execute arbitrary commands defined within the local repository's environment to validate changes.
- Evidence: Step 2 ('Run the smallest relevant checks... including tests, lint, build') and Step 7 ('Merge with gh or glab'). While these are standard developer actions, they involve executing logic from the local worktree which may be influenced by the changes being processed.
Audit Metadata