infrahub-reporting-issues
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes various CLI tools (
gh,infrahubctl,pip,ansible-galaxy,helm) to gather environment metadata and submit issues. These operations are strictly scoped to the skill's purpose and are governed by a mandatory user review gate. - [EXTERNAL_DOWNLOADS]: Issue templates are dynamically fetched from the vendor's (
opsmill) official GitHub repositories via the GitHub API. This ensures the reporter uses the most current intake forms provided by the maintainers. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from GitHub (search results and templates) and user-provided problem descriptions. While this presents a potential surface for indirect injection, the risk is mitigated by explicit instructions to display the final markdown payload to the user for manual verification and approval before execution.
- [CREDENTIALS_SAFE]: The skill includes a dedicated security rule (
env-info-sanitization) that explicitly forbids the inclusion of API tokens, secrets, or database connection strings in reports, instructing the agent to abort the process if such data is detected.
Audit Metadata