list-open-work
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from version control systems, creating a surface for indirect prompt injection.
- Ingestion points: The agent fetches PR/MR titles, branch names, and body content using
gh pr listandglab api(as defined inSKILL.md). - Boundary markers: The skill does not provide delimiters or instructions to the agent to ignore instructions embedded within the retrieved PR/MR content.
- Capability inventory: The skill utilizes shell execution for
git,glab, andghto perform repository and API operations. - Sanitization: No logic is included to sanitize or filter potential instructional content from the retrieved data before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill relies on executing multiple shell commands to gather repository information and interact with forge APIs.
- Evidence: The skill instructions invoke
git rev-parse,git remote,glab api, andgh pr list. While these are standard tools for the intended purpose, they represent an active command execution capability tier.
Audit Metadata