parallel-ci-triage
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data in the form of CI logs (GitHub Actions), which may contain instructions or malicious content intended to influence subagent behavior.
- Ingestion points: External workflow logs are fetched via GitHub CLI (
gh) or manually pasted into the conversation in SKILL.md (Workflow section). - Boundary markers: The prompt template for subagents lacks explicit delimiters (like XML tags or markdown blocks) or safety instructions to ignore embedded commands within the logs.
- Capability inventory: Subagents are instructed to "edit only what this job requires" and "Run the same commands locally that failed in CI", which provides significant system access that could be exploited by malicious logs.
- Sanitization: No sanitization or filtering of the log content is performed before passing it to subagents.
- [DATA_EXFILTRATION]: The skill's workflow relies on extracting and sharing log data which can inadvertently contain sensitive information like environment variables or tokens if not meticulously cleaned.
- Evidence: The skill notes "Redact secrets if pasting logs into chat," acknowledging the inherent risk of data exposure when handling raw CI output.
Audit Metadata