triage
Fail
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to "checkout" and "run relevant tests or commands" from external Pull Request diffs. Because PRs can be submitted by any user, this allows an untrusted actor to execute arbitrary code on the agent's host system.
- [REMOTE_CODE_EXECUTION]: Automatically executing tests or build commands from an external code contribution creates a direct path for remote code execution.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the GitHub issue tracker to guide its state machine and brief generation.
- Ingestion points: Issue descriptions, pull request bodies, and contributor comments in SKILL.md.
- Boundary markers: None. No delimiters or instructions are provided to help the agent distinguish between administrative instructions and untrusted data.
- Capability inventory: The agent has permission to checkout code, execute shell commands, and interact with the GitHub API (reading/writing issues and comments).
- Sanitization: None. The instructions do not require validation or filtering of external content before processing or interpolation.
- [DATA_EXFILTRATION]: If compromised via prompt injection, the agent's capabilities could be used to exfiltrate internal documentation, Architecture Decision Records (ADRs), or codebase details by posting them to public issue comments or PR reviews.
Recommendations
- AI detected serious security threats
Audit Metadata