implement-change
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data including "findings, a spec, tickets or a concrete request" (SKILL.md, description). This content is used to drive code modifications and PR creation.
- Ingestion Points: Ingestion occurs in Section 1 when reading "applicable repository instructions, the requested record/issue/spec and relevant decisions."
- Capability Inventory: The skill performs file system edits, executes build/validation commands (Section 3), and creates Draft PRs (Section 5).
- Boundary Markers: The instructions do not specify explicit delimiters (like XML tags or specific markers) to segregate untrusted data from system instructions, increasing the risk that instructions inside a ticket or spec could be obeyed by the agent as high-level commands.
- Sanitization: No specific sanitization or validation of the input data is mentioned before it is used to influence agent actions or code generation.
Audit Metadata