triage
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from an external source and possesses capabilities to execute commands and write to the filesystem.
- Ingestion points: The skill is instructed to "Read the full issue or PR (body, comments, labels, author, dates; for a PR, the diff too)" and "Parse any prior triage notes" (SKILL.md).
- Boundary markers: There are no explicit delimiters or boundary markers mentioned to separate untrusted issue/PR content from the agent's instructions, nor are there instructions to ignore embedded commands within that content.
- Capability inventory: The skill is authorized to perform several dangerous operations based on the ingested data: it can "Verify the claim" by checking out code and running "relevant tests or commands," and it can write to or update files like
GLOSSARY.md, ADRs, and the.out-of-scope/directory (SKILL.md). - Sanitization: The instructions do not mention any sanitization, filtering, or validation of the content read from the issue tracker before it is used to inform command execution or file writes.
Audit Metadata