new-raw
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a susceptibility to indirect prompt injection by design.
- Ingestion points: The skill extracts the 'most recent stretch of the user's own messages' from the conversation context in Step 2.
- Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the captured text, although it does rewrite specific asset tokens like
[Image #N]into HTML comments. - Capability inventory: The skill has the ability to execute
gh issue create,gh label create, andgh issue viewcommands. These are used to store the captured (potentially malicious) content in a persistent external system (GitHub). - Sanitization: There is no general sanitization, escaping, or validation of the user's verbatim words before they are interpolated into the GitHub issue body. This content is explicitly intended to be read as input by downstream skills such as
brainstormandplan, creating a multi-step injection chain.
Audit Metadata