triage
Warn
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to verify external pull requests by checking them out and running "relevant tests or commands". This behavior introduces a risk of executing malicious code embedded within an untrusted PR's test suite or build scripts.
- Evidence:
SKILL.md - "Verify the claim. ... For a PR, confirm the diff does what it claims — check it out, run the relevant tests or commands."
- [COMMAND_EXECUTION]: The skill uses shell commands to perform repository operations and verify external contributions, which can be manipulated if the source is untrusted.
- Evidence:
SKILL.md - "check it out, run the relevant tests or commands."
- [PROMPT_INJECTION]: The skill processes untrusted input from external contributors (issue and PR bodies, comments, and diffs) and possesses the capability to execute shell commands, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads issue and PR bodies, comments, author information, and diffs (
SKILL.md). - Boundary markers: Absent. There are no instructions to ignore or treat embedded instructions as data.
- Capability inventory: The skill is authorized to check out PR code and execute "relevant tests or commands" (
SKILL.md). - Sanitization: Absent. The skill does not describe any validation or filtering of the PR content before execution.
Audit Metadata