github-social
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from local repository files to populate a prompt template, which presents a surface for indirect prompt injection.\n
- Ingestion points: Step 1 of the workflow gathers repository signals (name, tagline, description) from local files.\n
- Boundary markers: The prompt template uses bracketed placeholders for interpolation but lacks explicit delimiters or instructions to ignore embedded commands in the source text.\n
- Capability inventory: The skill uses the gpt-image-2 tool and has the capability to write to the assets directory and modify the README.md file.\n
- Sanitization: No specific validation or sanitization of the extracted repository metadata is performed before it is used to generate the final image prompt.
Audit Metadata