fix-issue
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core workflow of processing external, user-supplied data.
- Ingestion points: The skill fetches untrusted content via
gh issue view(issue descriptions and comments) andWebFetch(external URLs for reproductions like StackBlitz, CodeSandbox, or third-party GitHub repositories). - Boundary markers: The instructions do not specify any delimiters or safety markers to help the agent distinguish between its instructions and the data being processed from the issues.
- Capability inventory: The agent has significant capabilities, including executing shell commands (
git,pnpm), modifying the local filesystem, opening Pull Requests, and editing GitHub issues. - Sanitization: There are no requirements for sanitizing or validating the code snippets or instructions extracted from external reproductions before they are used to generate tests or code fixes. An attacker could potentially craft a reproduction that tricks the agent into writing malicious tests or creating a backdoored PR.
Audit Metadata