setup-benny
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill configures automations that process untrusted data from external sources, creating a potential attack surface for indirect prompt injection. \n
- Ingestion points: Slack channel messages, threads, and media attachments (media review) are read by the triage and reproduction automations defined in SKILL.md. \n
- Boundary markers: The instructions include a defensive requirement to 'Wait for a trusted triage marker before acting' and to verify that markers originate only from a 'configured triage identity.' \n
- Capability inventory: The automations have extensive capabilities including Slack thread replies, issue tracker creation/updates, repository history access, pull request creation, and UI automation through a control adapter (as described in SKILL.md). \n
- Sanitization: The setup process implements identity verification for markers to prevent unauthorized activation of the reproduction and fix workflows. \n- [PERSISTENCE]: The skill facilitates the creation of persistent automation workflows within the host environment. \n
- Evidence: Section 7 ('Prepare the live automations') instructs the agent to use the host's 'durable automation, scheduled task, or long-running loop facility' to maintain functionality across sessions. \n- [COMMAND_EXECUTION]: The reproduction automation interacts with the local file system and code repositories to perform analysis and reproduction tasks. \n
- Evidence: Sections 4 and 7 describe requirements for 'repository read and history access' and 'a pull request action that can open a draft pull request.'
Audit Metadata