correct
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and acts upon untrusted data from the repository's history.
- Ingestion points: Instructions in
SKILL.mddirect the agent to "read recent commits, reverts, review comments, agent instruction files, and comments that explain workarounds." - Boundary markers: The skill lacks any instructions for the agent to use delimiters or to treat data from the commit history as untrusted content.
- Capability inventory: The agent is authorized to modify the repository ("Change the repo"), create new lints/CI checks, and modify or delete tests. These capabilities allow the agent to significantly alter the project's security posture.
- Sanitization: There is no requirement to sanitize or validate the content found in comments or commit messages before using it to define new repository rules.
- [COMMAND_EXECUTION]: The skill requires the execution of shell commands to verify fixes.
- Evidence: The agent is instructed to "Run the same command locally and in CI" to prove that new checks correctly identify past mistakes. This grants the agent the ability to execute build and test tooling within the environment.
Audit Metadata