triage
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from issue trackers and pull requests.
- Ingestion points: Reading issue bodies, comments, and pull request diffs as specified in
SKILL.md. - Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between its instructions and untrusted data content.
- Capability inventory: The agent can execute shell commands ("run tests/commands"), write to the repository filesystem (creating/updating files in
.out-of-scope/), and perform network operations by interacting with the GitHub/tracker API. - Sanitization: The instructions do not specify any validation or sanitization requirements for the untrusted input before processing.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to execute shell commands or tests to verify reports and pull requests. These commands are derived from or operate on untrusted external input.
- [REMOTE_CODE_EXECUTION]: By instructing the agent to "check out" and "run tests" on external pull request diffs, the skill facilitates the execution of code provided by potentially malicious external contributors. This represents a significant execution surface for untrusted code.
Audit Metadata