bug-fix
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issues, creating a potential surface for indirect prompt injection where an attacker could embed instructions within an issue description.
- Ingestion points: External data enters the agent context via the
gh issue viewcommand during Phase 1 (Investigation) as described inSKILL.md. - Boundary markers: No specific delimiters or instructions to ignore embedded commands within the issue content are mentioned in the workflow.
- Capability inventory: The skill has access to powerful tools including
Bash,Edit,Write,Read,Grep, andGlobas listed in theSKILL.mdfrontmatter. - Sanitization: There is no explicit sanitization of the fetched issue content; however, the skill mandates multiple human-in-the-loop or automated review gates (
/codex-test-review,/codex-review-fast, and/precommit) which serve as practical mitigations.
Audit Metadata