ship-it
Warn
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell scripts located within the repository, such as
./scripts/hooks/lint.sh. If the repository or a pull request contains malicious code in these scripts, the agent will execute it during the fix-and-verify phase. - [DYNAMIC_EXECUTION]: The skill dynamically identifies and loads another skill from the repository's file system at
<repo>/.claude/skills/code-review/SKILL.md. Loading executable logic from a path computed at runtime based on the target repository is a security concern. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from pull request titles, descriptions, and code diffs. This data could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: PR title, body, linked issue, and code diff (as described in Step 1).
- Boundary markers: No explicit delimiters are used to separate PR content from the skill's instructions.
- Capability inventory: The skill can execute local scripts, load additional instructions, and perform repository actions such as pushing commits and merging pull requests.
- Sanitization: Pull request content is not sanitized or validated for instructional patterns before processing.
Audit Metadata