multi-tool-finding-triage
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and merges external security reports in JSON and SARIF formats, creating a surface where malicious instructions or deceptive content in a report could influence the agent's summary or mislead human reviewers. The evidence chain is as follows:\n
- Ingestion points: The tool discovers and reads
*.jsonand*.sarifreports from the workspace, as described in Step 1 ofSKILL.mdand implemented in thecollect()function ofci/gate.mjs.\n - Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings used when interpolating external finding messages into report templates (see Step 7 of
SKILL.md).\n - Capability inventory: The skill is capable of generating pull request comments via the
gh pr commentcommand and directly influencing CI/CD pipeline outcomes through exit codes based on the findings.\n - Sanitization: The provided logic in
lib/triage.jsandci/gate.mjslacks evidence of escaping or filtering content from external reports before it is rendered in the final output summary.\n- [EXTERNAL_DOWNLOADS]: The skill fetches vulnerability enrichment data from reputable and well-known services to provide high-fidelity triage. These operations are documented neutrally as they represent the skill's intended functionality:\n - Downloads the Known Exploited Vulnerabilities (KEV) catalog from the official CISA website (
www.cisa.gov).\n - Fetches EPSS (Exploit Prediction Scoring System) data from Empirical Security's daily feed and the First.org API.\n
- References specifications and tools from trusted public repositories, including OpenVEX, TruffleHog, and Gitleaks.
Audit Metadata