triage-mr
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests MR/PR comments from remote platforms (GitHub and GitLab) using
ocr-pull-discussions.py. These comments are untrusted external data that may contain malicious instructions designed to influence the agent or the sub-processes in/skill:fix. - Ingestion points: Remote comments are pulled and stored in
.triage/<MR_ID>/issues.jsonin SKILL.md. - Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions when passing this content to the agent or other skills.
- Capability inventory: The skill executes local scripts, manages local state, and interacts with GitHub/GitLab APIs to post labels and resolve threads.
- Sanitization: No explicit sanitization or filtering of the fetched comment content is mentioned.
- [COMMAND_EXECUTION]: The skill relies on executing local Python scripts (
ocr-pull-discussions.py,verdict.py,ocr-post-labels.py,ocr-verify-resolved.py) and platform CLI tools (ghandglab). While these are necessary for the skill's primary function, they execute with the agent's permissions.
Audit Metadata