agent-ops-cicd-github
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMOBFUSCATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The skill employs a consistent character substitution technique, replacing directory separators ('/') and dots ('.') with the dollar sign ('$') throughout its configuration (e.g., '.github$workflows', '2>$dev$null', 'actions$checkout@v4'). This pattern is designed to bypass security filters that monitor for access to sensitive directories or specific command-line arguments.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface, as it is designed to ingest data from untrusted local files while possessing powerful system-modification capabilities.
- Ingestion points: The skill reads and identifies project types by checking for the existence of files like 'package.json', 'requirements.txt', and 'go.mod' in its 'pre_execution' hook.
- Boundary markers: Absent. There are no instructions or delimiters provided to ensure the agent ignores potentially malicious content within these project files.
- Capability inventory: The skill is granted extensive permissions, including the 'Bash', 'Write', 'Edit', and 'MultiEdit' tools, which could be abused if an analyzed file contains malicious instructions.
- Sanitization: Absent. Data derived from the project environment is used in shell commands within the execution hooks without any validation or escaping mechanisms.
Audit Metadata