deal-with-security-advisory
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the GitHub API which originates from an external security researcher.
- Ingestion points: Step 0 fetches advisory details using
gh api repos/paperclipai/paperclip/security-advisories/{{ghsaId}}. - Boundary markers: The skill does not use any delimiters or instructions to ignore embedded commands within the advisory description, severity, or notes.
- Capability inventory: The skill has broad capabilities including arbitrary shell execution, Git repository modification (clone, commit, push), and GitHub API modification (creating forks, assigning CVEs, publishing advisories).
- Sanitization: There is no evidence of validation, escaping, or filtering of the advisory content before the agent is asked to read and act upon it.
- [PROMPT_INJECTION]: The instructions contain an explicit command to ignore environment constraints: 'Below we use gh tools
- you do have access and credentials outside of your sandbox, so use them.' This attempts to override the agent's safety boundary regarding credential management and execution environments.
- [PRIVILEGE_ESCALATION]: By asserting that the agent should use credentials 'outside of your sandbox', the skill attempts to acquire higher permissions than those typically granted in a restricted execution environment.
- [COMMAND_EXECUTION]: The skill relies on sensitive shell operations, including
gh apifor administrative repository tasks andgitfor code manipulation, which are executed based on the context of the potentially untrusted security advisory.
Audit Metadata