meta-issue-to-pr-autopilot
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through external GitHub issue data.
- Ingestion points: Untrusted content is retrieved in the fetch_issue step and processed by the sub-agent in the patch step.
- Boundary markers: The composition lacks explicit delimiters or instructions to ignore embedded commands within the fetched issue data.
- Capability inventory: The skill uses vcs, filesystem-write, network-write, and subprocess capabilities, which increases the potential impact of a successful injection.
- Sanitization: While user input is xml-escaped, content fetched from external repository issues is not sanitized or validated against instruction overrides.
Audit Metadata