triage
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill directs the agent to check out and run tests or commands from external pull requests to verify the provided code, which involves executing potentially malicious code from untrusted sources. Evidence: SKILL.md includes the instruction, 'For a PR, confirm the diff does what it claims — check it out, run the relevant tests or commands.'
- [PROMPT_INJECTION]: The skill's workflow involves reading and processing untrusted data from GitHub issues and comments, creating an indirect prompt injection surface.
- Ingestion points: Reads issue bodies and discussion threads in the 'Gather context' step of SKILL.md.
- Boundary markers: Lacks protective delimiters for external content to prevent the agent from obeying embedded instructions.
- Capability inventory: The agent has permissions to post comments, label issues, and modify local repository files like '.out-of-scope/*.md' or 'CONTEXT.md'.
- Sanitization: No sanitization or input validation is defined for the ingested data.
Audit Metadata