pr
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches content from external GitHub issues and uses this untrusted data to drive automated implementation and planning.
- Ingestion points: Fetches issue data in Phase 1 via
gh issue view #$ARGUMENTS. - Boundary markers: Lacks delimiters or instructions to treat issue content as untrusted data.
- Capability inventory: File writing (
issue_analysis_$ARGUMENTS.md,pr_plan_issue_$ARGUMENTS.md), codebase modification, git branch management, and automated pull request creation viagh pr create. - Sanitization: No validation or sanitization of the issue content is performed before processing.
- [COMMAND_EXECUTION]: The user-supplied
$ARGUMENTSis directly interpolated into shell commands, which presents a command injection risk. - Evidence: The argument placeholder is used directly in
git worktree ./worktree-issue-$ARGUMENTS-[desc],git checkout -b issue-$ARGUMENTS-[brief-description], andgh issue view #$ARGUMENTS. - Risk: Maliciously crafted arguments containing shell metacharacters could execute unintended shell commands if the environment does not provide native sanitization for placeholders.
Audit Metadata