triage-pr
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its automated processing of untrusted external content.
- Ingestion points: The agent ingests data from GitHub Actions failure logs (SKILL.md Step 2) and PR review comments/threads via the
scripts/review-threads.mjsfetcher (SKILL.md Step 8). - Boundary markers: Absent. The instructions do not provide technical delimiters or specific guidance to ignore embedded instructions when the agent parses log content or review feedback.
- Capability inventory: The agent has extensive capabilities including file modification (
Read,Edit,Write), shell execution viagh,git,node,pnpm, andnpx, and the ability to manage Linear issues via MCP tools. - Sanitization: Absent. While basic markdown escaping is performed for table formatting, no sanitization or filtering is applied to the ingested content to prevent the execution of injected instructions.
- [PROMPT_INJECTION]: A static analysis hint regarding action concealment was identified in SKILL.md. Upon review, the instruction to "stay quiet while watching" is a documented design choice intended to reduce user interruptions during long-running CI tasks (Step 6), not a malicious attempt to hide unauthorized actions. This pattern is considered benign in the context of a triage automation tool.
Audit Metadata