vp-autodev
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection because it is designed to ingest and act upon data from external, potentially untrusted sources while possessing high-privilege capabilities (e.g., committing code, merging pull requests, and publishing releases).
- Ingestion points: The skill reads issue descriptions (validate phase), technical research data (research phase), CI/CD signal outputs (observe feedback phase), and pull request conversation/comments (observe feedback phase).
- Boundary markers: The skill uses a structured 'Delivery Brief' and confirmation checklists to track state, but it lacks explicit instruction delimiters or specific warnings to ignore natural language instructions embedded within the ingested data (e.g., instructions hidden in issue bodies or PR comments).
- Capability inventory: The skill possesses the authority to perform file writes (implement phase), execute Git commands (branch, commit, push), interact with the GitHub API (create/transition PRs), and perform administrative repository actions (merge, release).
- Sanitization: No explicit sanitization or filtering of external content is defined before it is processed by the agent's logic.
Audit Metadata