triage
Fail
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to verify external Pull Requests by performing a checkout and running 'relevant tests or commands' derived from the PR diff. This allows for execution of arbitrary, potentially malicious code provided by untrusted external contributors.
- [COMMAND_EXECUTION]: The verification process requires the agent to execute shell commands and test suites directly from external PR content, creating a direct command injection surface within the agent's operating environment.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the ingestion of untrusted data from issue bodies, comments, and PR diffs. This data is used to generate agent briefs and modify core project files such as ADRs and CONTEXT.md. Ingestion points: Issue/PR bodies, comments, and diffs (SKILL.md). Boundary markers: None specified for input processing. Capability inventory: File system write access, network operations (comment posting), and shell command execution. Sanitization: No sanitization or validation of external content is mentioned.
- [DATA_EXFILTRATION]: By executing untrusted code and tests from external PRs, the agent environment is exposed to exfiltration of sensitive information, including environment variables, repository secrets, and local credentials.
Recommendations
- AI detected serious security threats
Audit Metadata