triage
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8) by processing untrusted data from issue trackers.
- Ingestion points: The agent reads the full issue context, including the body and comments, from the project's issue tracker as instructed in SKILL.md under the 'Gather context' section.
- Boundary markers: The instructions do not define clear delimiters or specific warnings to ignore instructions embedded within the ingested issue content.
- Capability inventory: The skill has the capability to modify issue states and labels, post comments, write files to the repository (the .out-of-scope/ directory), and execute shell commands for bug reproduction.
- Sanitization: There is no instruction to validate or sanitize external issue content before the agent acts on it.
- [COMMAND_EXECUTION]: The reproduction workflow in SKILL.md directs the agent to "run tests or commands" derived from the reporter's steps. This creates a vector for executing arbitrary shell commands if a malicious actor provides dangerous instructions in an issue report.
Audit Metadata