publish
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses YAML and JSON 'Seed' files from the local filesystem (
~/.ouroboros/seeds/). The data from these files is interpolated directly into the titles and bodies of GitHub issues. - Ingestion points: Local specification files identified in Step 2 and parsed in Step 3.
- Boundary markers: The skill uses quoted heredocs (
--body "$(cat <<'BODY' ... BODY)") in Step 7, which effectively prevents shell command injection from the file content into the execution environment. - Capability inventory: The skill uses
run_shellto executeghCLI commands and perform file system operations. - Sanitization: While shell-level injection is prevented, the skill does not explicitly sanitize the natural language content within the seed files before it is processed by the agent to create issue descriptions.
- [COMMAND_EXECUTION]: The skill utilizes the
gh(GitHub) CLI to perform repository operations, including creating labels, creating issues, and adding comments. - Target Validation: The skill explicitly asks the user for the target repository (
TARGET_REPO) before performing write operations. - Tool Usage: Commands such as
gh label create,gh issue create, andgh issue commentare used according to standard development workflows.
Audit Metadata