repo-impact-optimizer
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves processing untrusted external data from existing repositories (READMEs, documentation, configuration files, and code). This environment is susceptible to indirect prompt injection, where an attacker could embed malicious instructions in a repository to hijack the agent's behavior during the audit.
- Ingestion points: The workflow in
SKILL.md(Step 1) explicitly directs the agent to read a wide array of files including READMEs, CI configs, manifests, and commits. - Boundary markers: The instructions lack boundary markers or warnings to disregard instructions found within the repository files.
- Capability inventory: The agent uses file system tools to read content and is encouraged to perform shell execution in the next step.
- Sanitization: There is no provision for sanitizing or validating the contents of the files being read before they are processed by the agent.
- [COMMAND_EXECUTION]: The instruction in
SKILL.mdto "Run the documented install or quick start when you can" effectively directs the agent to execute arbitrary shell commands or scripts found within an untrusted repository. If the repository being audited contains a malicious installation script or README instructions (e.g., piped curl-to-bash commands), the agent may execute them as part of its documented workflow.
Audit Metadata