triage
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external, untrusted sources such as GitHub issue descriptions, user comments, and pull request diffs, which creates a vulnerability surface for malicious instructions embedded in those inputs.
- Ingestion points: The 'Gather context' step in SKILL.md reads the full issue/PR body, comments, and diffs into the agent's context.
- Boundary markers: The instructions do not define specific delimiters or directives to ignore embedded instructions within the ingested data.
- Capability inventory: The agent is authorized to post comments, close issues, modify the
.out-of-scope/directory, and execute shell commands for testing. - Sanitization: There are no specified procedures for sanitizing or escaping the external content before it is processed or interpolated into downstream actions.
- [COMMAND_EXECUTION]: The triage workflow in SKILL.md requires the agent to verify pull requests by checking out the code and running 'relevant tests or commands.' This behavior involves executing code provided by external contributors, which could lead to unauthorized actions if the code is malicious.
Audit Metadata