blast-radius
Warn
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill explicitly instructs the agent to generate and execute code to verify behavior.
- Evidence: In SKILL.md, Step 5 states: 'Write a script or test that runs the real code, run it, and paste what happened.'
- Evidence: Step 4 under 'How sure are you' suggests: 'You ran it. A script or test that calls the real code and fails loud if you're wrong.'
- This involves the agent creating and running local scripts (e.g., Python, Node.js) that import project libraries, which could lead to unintended consequences if the generated code is flawed or influenced by malicious inputs.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data.
- Ingestion points: The skill reads code diffs and is instructed to 'pull the PR and commits' (Step 1), which includes potentially attacker-controlled content in pull request descriptions or commit messages.
- Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within the ingested data are provided.
- Capability inventory: The agent has the capability to write and execute scripts locally (as noted in the dynamic execution section) and perform file system searches via grep.
- Sanitization: There is no mention of sanitizing or escaping the content retrieved from external PRs or diffs before processing it.
Audit Metadata