@tank/bdd-issue-fixer
Pass
Audited by Gen Agent Trust Hub on May 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads untrusted content from GitHub issues and comments. An attacker could craft an issue containing instructions designed to manipulate the agent's actions during the fix process. Evidence: 1. Ingestion points: Data retrieved via gh issue view (title, body, comments) as described in the triage and reading protocols. 2. Boundary markers: None mentioned for the raw issue text to prevent instruction following. 3. Capability inventory: The skill utilizes shell access for git operations, gh CLI commands, and project-specific test runners and build tools. 4. Sanitization: No explicit sanitization or validation of the ingested issue text is performed.
- [COMMAND_EXECUTION]: The workflow relies on executing shell commands for repository management, issue tracking, and running automated tests and build processes.
Audit Metadata