qa-changes
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill methodology instructs the agent to install dependencies and build projects from untrusted pull request branches.\n
- Evidence: The instructions in
SKILL.mdspecify using tools likenpm install,pip install, andcargo buildon the code within the pull request. This allows for the execution of malicious scripts (e.g.,preinstallorpostinstallscripts) defined in the PR's configuration files.\n- [COMMAND_EXECUTION]: The agent is directed to exercise the PR changes by running servers, CLI commands, and application code.\n - Evidence: An attacker-controlled PR could contain malicious code designed to execute arbitrary shell commands when the agent attempts to verify functionality as instructed in the "Exercise" phase of
SKILL.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to read and follow instructions from sources controlled by the PR author.\n - Ingestion points: PR diffs, PR descriptions, and repository files such as
AGENTS.md,README.md, andMakefile(referenced inSKILL.md).\n - Boundary markers: Absent. The agent is specifically told to "Always prefer the project's own documented setup commands."\n
- Capability inventory: The agent uses shell execution, network operations, and file system modifications to perform QA tasks.\n
- Sanitization: None. The instructions do not warn the agent to validate or ignore instructions found in the untrusted data.
Audit Metadata