verify-in-repo
Warn
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (
gh issue view,gh search prs,git log) by interpolating the{issueId}and{repo}arguments directly into shell strings. If these arguments are provided by an untrusted user and contain shell metacharacters (such as;,&,|, or backticks), it could result in arbitrary command execution on the host environment. - [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection because it retrieves and processes untrusted data from GitHub issue titles, bodies, and comments to decide whether to proceed with an autofix chain. Malicious content within an issue could be used to manipulate the agent's decision-making process.
- Ingestion points: Content retrieved via
gh issue view(title, body, comments) andgh search prs(PR titles). - Boundary markers: Absent. The skill does not define delimiters or provide instructions to treat the issue content as untrusted data.
- Capability inventory: The skill has access to the filesystem (read-only), network access to GitHub via
gh, and the ability to execute git and shell commands. - Sanitization: Absent. There are no instructions to escape, validate, or filter the external content before it is analyzed by the agent.
Audit Metadata