triage
Warn
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issues, PR descriptions, comments, and code diffs, creating a surface for injection attacks.\n
- Ingestion points:
SKILL.mddescribes reading the full context of issues and PRs, including all comments and diffs.\n - Boundary markers: The instructions lack specific guidance on using delimiters or "ignore" warnings when the agent processes these untrusted inputs to prevent the execution of malicious instructions embedded in descriptions or comments.\n
- Capability inventory: The agent is authorized to checkout code, execute shell commands and tests, write comments to the issue tracker, and modify repository files (specifically in the
.out-of-scope/directory).\n - Sanitization: No sanitization or input validation logic is defined for the external content.\n- [REMOTE_CODE_EXECUTION]: The skill requires the agent to checkout and execute code (tests or commands) from external Pull Requests to verify functionality.\n
- Evidence: In
SKILL.md, the verification step for a specific issue or PR explicitly states "checkout 全退, 跑相关测试或命令" (checkout, run related tests or commands). Executing code from external, untrusted sources like PRs is a significant risk vector for compromise.
Audit Metadata