repo-research
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process code, issues, and pull requests from external, untrusted repositories on platforms like GitHub, GitLab, and Bitbucket. This establishes an attack surface where malicious content within those repositories could attempt to influence the agent's instructions or behavior.
- Ingestion points: The skill utilizes a helper script at
scripts/git-clone.shto clone remote repositories to a local cache, uses theghCLI to fetch repository metadata, and leverages Sourcegraph for codebase searching. - Boundary markers: The instructions do not specify the use of clear delimiters or XML tags to wrap ingested external content, which is a recommended practice to prevent the agent from confusing ingested data with primary instructions.
- Capability inventory: The agent has the capability to execute the provided local bash script to clone repositories, read files from the filesystem, and perform network operations to fetch external data.
- Sanitization: There is no evidence of automated filtering or sanitization of the content fetched from remote repositories before it is presented to the agent context.
Audit Metadata