triage
Warn
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates the
<issue>argument directly into a shell command (gh issue view <issue> --json ...). This allows for potential command injection if a user provides an issue number containing shell metacharacters like semicolons or pipes.\n- [DATA_EXFILTRATION]: The skill collects GitHub issue data (title, body, labels) and codebase structural information (count of files containing specific write-related API calls) and transmits this information to an external, non-whitelisted domain (api.typesafe.ai) for analysis.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issues without sanitization or boundary markers, then passes this data to an LLM. Malicious instructions hidden in a GitHub issue could potentially manipulate the triage result or influence the subagent's behavior.\n - Ingestion points: Retrieves GitHub issue title, body, and labels using the
ghCLI tool inSKILL.md.\n - Boundary markers: None identified; untrusted issue data is concatenated directly into the state used for LLM prompts.\n
- Capability inventory: The skill has permissions to write to the filesystem and perform network operations via
curl.\n - Sanitization: None identified; instructions specify passing the full issue body to the API to maintain accuracy.
Audit Metadata