work
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection by design. It ingests untrusted data from external sources and uses that data to drive high-privilege actions.
- Ingestion points: In
SKILL.md(Phase 1, Step 1), the agent uses thegh apitool to fetch the body of GitHub issue comments marked with<!-- tunan:plan -->and<!-- tunan:gate -->. These comments are authored by potentially untrusted users in the repository. - Boundary markers: The instructions lack specific requirements to wrap the ingested plan content in XML tags or other delimiters when passing it to the subagent dispatcher or processing it locally. The skill explicitly states 'The plan... is the authority,' increasing the risk that the agent will obey malicious instructions embedded in the plan.
- Capability inventory: The skill possesses extensive capabilities, including
git(branching, committing, merging),gh(issue creation and commenting), file system modification, and the ability to dispatchAgentsubagents with custom instruction packets. A malicious plan could instruct the agent to modify sensitive files, delete code, or perform unauthorized GitHub actions. - Sanitization: There is no evidence of sanitization, validation, or filtering of the external plan content before it is interpolated into subagent prompts or used to derive command arguments.
Audit Metadata