worker-protocol
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the worker agent to ingest potentially untrusted data from external sources.
- Ingestion points: The agent is directed to "Read assigned issue completely" and "Check issue comments for context/history" in SKILL.md.
- Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for these ingestion steps.
- Capability inventory: The agent has access to git for code modification, pnpm for command execution (tests), and the GitHub CLI (gh) for posting comments and creating Pull Requests.
- Sanitization: There are no instructions for sanitizing or validating the content retrieved from GitHub issues or comments before the agent processes it.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute various shell commands for its primary purpose as a developer tool.
- Uses git status, git branch, and pnpm test for local environment verification and testing.
- Uses gh api to interact with GitHub issues and verify the presence of review artifacts.
- [SAFE]: The skill includes positive security practices that mitigate risk.
- Proactively identifies security-sensitive file patterns (e.g., auth, api, password, token, secret) and mandates a specific security-review skill invocation if these are modified.
- Implements a review gate that blocks PR creation unless a machine-parseable review artifact with zero unaddressed findings is found.
Audit Metadata