triage
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It reads untrusted data from external sources (GitHub issue bodies and comments) to gather context for triage decisions. Malicious actors could embed instructions in these fields to manipulate the agent's behavior during the 'Recommend' or 'Reproduce' steps.
- Ingestion points: External GitHub issue content, including bodies, comments, and reporter information (SKILL.md).
- Boundary markers: None defined; the agent is instructed to read the full issue context directly.
- Capability inventory: Performing GitHub actions (labeling, commenting, closing issues), writing files to the local filesystem (
.out-of-scope/*.md), and executing shell commands for bug reproduction. - Sanitization: No sanitization or validation logic is specified for the ingested issue data.
- [COMMAND_EXECUTION]: The skill instructions specify that the agent should 'run tests or commands' to reproduce reported bugs based on steps provided by the issue reporter. This capability allows for the execution of shell commands influenced by untrusted external input.
Audit Metadata