triage
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and acts upon untrusted data from an issue tracker.
- Ingestion points: In
SKILL.md, the 'Gather context' step specifically instructs the agent to read the full body and all comments of an issue, which are provided by external reporters. - Boundary markers: The instructions lack explicit boundary markers or 'ignore' directives to prevent the agent from following instructions embedded within the issue content itself.
- Capability inventory: The skill possesses significant capabilities, including running shell commands for bug reproduction, writing to the
.out-of-scope/directory, and posting automated comments to the issue tracker (SKILL.md). - Sanitization: There is no mechanism described for sanitizing, filtering, or escaping the external content before it is interpolated into the agent's reasoning process.
- [COMMAND_EXECUTION]: The bug reproduction workflow requires the agent to execute code or commands within the project environment.
- Evidence: In
SKILL.md, the 'Reproduce (bugs only)' section directs the agent to 'run tests or commands' based on 'the reporter's steps'. This creates a surface where a malicious reporter could craft reproduction steps that attempt to execute unauthorized commands if the agent follows the steps too literally or without sufficient isolation.
Audit Metadata