triage
Warn
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from external issue trackers (issue body, comments, and reporter metadata) within the 'Triage a specific issue' section of SKILL.md.
- Ingestion points: SKILL.md (Step 1: Gather Context) reads all issue content and comments.
- Boundary markers: Absent; there are no instructions to delimit or ignore embedded instructions within the ingested text.
- Capability inventory: File reads (codebase), file writes (.out-of-scope/), command execution (reproduction steps), and network operations (posting comments).
- Sanitization: Absent; the skill does not filter or escape external content before processing.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to 'run tests or commands' derived from 'the reporter's steps' during bug reproduction in SKILL.md. This provides a mechanism for arbitrary command execution triggered by external users providing malicious instructions in issue reports.
- [DATA_EXFILTRATION]: The skill aggregates broad codebase context and prior triage data, then posts 'Triage Notes' or 'Agent Briefs' to an external issue tracker. An attacker could use indirect prompt injection to trick the agent into including sensitive information from the codebase or environment in these public-facing comments.
Audit Metadata