triage
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted input from issue trackers (bodies and comments) during the 'Gather context' and 'Reproduction' phases, creating an indirect prompt injection attack surface.
- Ingestion points: Untrusted data enters via GitHub issue bodies and comments as specified in
SKILL.md. - Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within ingested issue data.
- Capability inventory: The skill can read repository files, write to the
.out-of-scope/directory, post comments, and execute shell commands/tests. - Sanitization: No sanitization or verification logic is present to validate the safety of instructions extracted from external issue reports.
- [COMMAND_EXECUTION]: The bug reproduction workflow in
SKILL.md(Step 3) explicitly directs the agent to 'run tests or commands' described by the reporter. This could lead to the autonomous execution of malicious code if a user crafts a bug report containing harmful shell commands.
Audit Metadata