apply-fix
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands defined in the project's local configuration file (
.ai/agentic.config.json) under thevalidation.commandskey. These commands are used to verify code changes through testing, linting, or type-checking routines specified by the project owner.\n- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) to automate issue management tasks, such as assigning users, applying labels, and posting status comments. These operations are scoped to the repository context provided via arguments.\n- [PROMPT_INJECTION]: The skill processes instructions from a preceding automated step (root-cause). This presents a surface for indirect prompt injection if the original data source (e.g., a GitHub issue) contains adversarial content intended to influence the agent's behavior. \n - Ingestion points: The skill reads an 'analyzer brief' from the previous step as part of its instructions in
SKILL.md.\n - Boundary markers: The input is delimited by a '— PREVIOUS STEP (root-cause) said —' marker.\n
- Capability inventory: The skill possesses the ability to modify files, execute shell commands (via validation gates), and interact with the GitHub API.\n
- Sanitization: The skill includes mitigation instructions, requiring the agent to manually re-read affected code if the brief is marked as 'LOW_CONFIDENCE' and to perform a self-review against project security and data-access conventions before completion.\n- [SAFE]: The repository-level operations, such as file modification and local command execution, are standard for developer productivity agents and do not involve unauthorized network access or credential exfiltration.
Audit Metadata