triage
Fail
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to 'check it out, run the relevant tests or commands' when triaging external pull requests. This executes arbitrary code provided by untrusted external contributors. (File: SKILL.md, Step 3)
- [COMMAND_EXECUTION]: The instructions provide the agent with the authority to execute shell commands found in or associated with external pull requests without a restricted list of safe commands. (File: SKILL.md, Step 3)
- [PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection as it ingests untrusted text and code from external contributions to drive its state machine and execution steps.
- Ingestion points: The agent reads the full body, comments, and diff of external issues and PRs (SKILL.md, Step 1).
- Boundary markers: Absent. The skill provides no instructions to separate untrusted data from its primary instructions.
- Capability inventory: The agent can execute subprocesses (tests/commands), write to the repository's filesystem (.out-of-scope/ directory), and modify issue/PR states (labels, comments, closing).
- Sanitization: Absent. There is no evidence of filtering or validation for the content ingested from external contributors.
Recommendations
- AI detected serious security threats
Audit Metadata