vp-autodev
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a significant attack surface by ingesting and acting upon untrusted external data during its development workflow.
- Ingestion points: As defined in SKILL.md (Steps 7-10) and the reviewer signals reference, the agent fetches and processes 'bot comments', 'pull request review comments', 'issue comments in the PR conversation', and 'reaction emoji'.
- Boundary markers: The instructions do not define any boundary markers or warnings to the agent to distinguish between user-authorized instructions and embedded instructions within external comments.
- Capability inventory: The agent possesses the capability to perform 'commit', 'push', 'merge', and 'release follow-up' operations (SKILL.md Steps 4, 11, and 12).
- Sanitization: Actionable items from these external surfaces are routed directly to a resolver skill (vp-pr-comment-resolver) without a described sanitization or filtering phase, which could allow malicious instructions to bypass oversight.
- [COMMAND_EXECUTION]: The skill facilitates highly autonomous execution of repository-level operations.
- Evidence: The agent is authorized to create branches, commit code, push changes, and merge pull requests. While this autonomy is a core feature for authorized repositories, it amplifies the impact of any successful prompt injection or misalignment during the automated development lifecycle.
Audit Metadata