maintainer-review
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill enables the agent to execute shell commands using the GitHub CLI tool.
- Evidence: The workflow instructions (SKILL.md, Section 1) allow the agent to run the
ghcommand on the host machine if the user explicitly requests it. - [REMOTE_CODE_EXECUTION]: The skill defines a process for executing code patches retrieved from remote GitHub Pull Requests.
- Evidence: The "Stage 2: approved runtime probe" (SKILL.md, Section 4) instructs the agent to perform focused local reproductions of claims found in pull requests.
- Mitigation: The skill mandates explicit user approval before execution and requires the use of a specific tool (
$runtime-behavior-probe) that is expected to manage environment gates and cleanup. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and analyze untrusted data from external sources.
- Ingestion points: The agent reads content from GitHub issue URLs, PR bodies, comments, and reproduction steps (SKILL.md, Section 1).
- Boundary markers: The skill does not implement explicit delimiters or boundary markers to distinguish instructions from untrusted external data.
- Capability inventory: The agent possesses powerful capabilities, including command execution and code reproduction, which could be exploited if the agent follows instructions embedded in a malicious GitHub issue.
- Sanitization: No explicit sanitization or filtering of the ingested external content is described in the workflow.
Audit Metadata