codex-issue-coordinator
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to read and process external, untrusted content from GitHub issues and pull requests to drive its automated workflow. 1. Ingestion points: The skill reads repository instructions, parent issues, native sub-issues, and project boards in the SKILL.md Preconditions section. 2. Boundary markers: No explicit delimiters or boundary markers are defined to isolate external data from the coordinator's instructions in the worker prompt. 3. Capability inventory: The skill can execute tests, commit code, push to remote repositories, and merge pull requests. 4. Sanitization: The instructions do not specify any validation or sanitization of the content fetched from external GitHub sources.
- [COMMAND_EXECUTION]: The coordinator and workers are authorized to perform repository-altering commands, including branch creation, code commits, and pull request merges. While these are gated by specific conditions, these capabilities provide a significant attack surface if the agent is influenced by malicious instructions embedded in a GitHub issue.
Audit Metadata