work-on-issues
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches issue titles, bodies, and comments from external trackers (GitHub/GitLab) and uses this untrusted data to generate prompts for a sub-agent. Ingestion points: Issue data fetched via
ghorglabCLI commands in Section 2 and 5. Boundary markers: The skill instructions do not define delimiters or "ignore instructions" warnings for the ingested issue content. Capability inventory: Includes shell command execution (git,cp), network access via tracker CLIs, and a high-privilegefull-stack-engineersub-agent capable of arbitrary code execution. Sanitization: No evidence of sanitization, filtering, or validation of the external issue data before it is passed to the sub-agent. - [CREDENTIALS_UNSAFE]: The implementation phase (Section 4 and 5) involves automatically copying
.envand.env.*files into sub-agent worktrees and propagating them back. These files commonly contain sensitive credentials (API keys, secrets), which are then placed in a context controlled by untrusted external instructions. - [COMMAND_EXECUTION]: The skill uses local shell commands including
git worktree add,cp, andgit worktree removeto manage the development environment. These commands are executed using parameters (issue numbers, titles) derived directly from remote, untrusted sources.
Audit Metadata