work-implement
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from issue trackers which could potentially contain malicious instructions.\n
- Ingestion points: Issue bodies and comments are retrieved from GitHub, GitLab, and Linear via forge-specific tools (gh, glab, MCP) as described in Step 6.\n
- Boundary markers: The instructions specify that the issue body serves as the source of requirements, though no technical delimiters are explicitly used for the data payload.\n
- Capability inventory: The skill can modify source code (Edit/Write tools) and execute arbitrary shell commands (Bash tool) defined in the repository's verification scripts.\n
- Sanitization: A strict 'Author Authority' mechanism is implemented (see REFERENCE.md), verifying that only text from authors with write or admin permissions is treated as instructional; other content is treated as non-instructional context.\n- [COMMAND_EXECUTION]: The skill executes verification commands (e.g., build and test scripts) defined within the project it is working on in Step 7.\n
- The skill provides extensive security guidance for isolating these executions within sandboxed environments (e.g., restricted network, read-only mounts, resource limits) to protect the host environment from potentially malicious repository content.
Audit Metadata