qa
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes conversational user input to generate and file GitHub issues, creating a surface for indirect prompt injection attacks.
- Ingestion points: The interactive session where users describe problems, reproduction steps, and expectations (SKILL.md).
- Boundary markers: None. The skill interpolates user descriptions directly into issue templates without using delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill can read the local codebase via a subagent and write to the remote repository using the
gh issue createcommand. - Sanitization: Absent. While the agent is instructed to use domain language and clarify steps, there is no validation or filtering of the content provided by the user before it is passed to the shell command. The instruction to "Do NOT ask the user to review first" increases the risk of auto-publishing malicious or unauthorized content.
- [COMMAND_EXECUTION]: The skill executes the
gh issue createcommand to interact with GitHub. This command is driven by user-supplied data, which, if not properly handled by the underlying agent platform, could be manipulated to include unauthorized flags or metadata in the repository's issue tracker.
Audit Metadata