vp-checklist-runner
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PRs and issues to determine which verification steps to run.
- Ingestion points: The skill fetches PR or issue content to identify checklist items (defined in
SKILL.md). - Boundary markers: The instructions explicitly require excluding fenced and inline code before identifying items, which serves as a mitigation against embedded malicious code.
- Capability inventory: The skill is authorized to run "repository-owned scripts" and "reproducible commands" (defined in
references/verification-recipes.md) and perform external writes to the hosting platform (defined inreferences/checkbox-update-rules.md). - Sanitization: There is a requirement to exclude code formatting, but no formal sanitization or schema validation for the natural language checklist items themselves before they are processed by the agent.
- [COMMAND_EXECUTION]: The skill encourages running repository-specific scripts and tools to verify checklist claims. While this is the intended functionality, it relies on the integrity of the repository being audited.
- Evidence:
references/verification-recipes.mdstates: "For commands, use repository-owned scripts and current tool help."
Audit Metadata