cubrid-loop-pr
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs extensive local command execution using
git,gh, andbash. It executes an embedded Python script to compare the current git status against a baseline captured at startup. This ensures that only new modifications generated during the fix loop are staged and committed, preventing the accidental inclusion of unrelated local changes. - [PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a surface for indirect prompt injection. PR titles, descriptions, and CI failure logs are ingested and then included in subsequent prompts to guide the code-fixing process. A malicious actor could attempt to influence the agent's behavior by placing specific instructions within these external strings.
- Ingestion points: Pull request metadata (title, body) and CI job logs retrieved from GitHub and CircleCI.
- Boundary markers: The skill structures the failure summary in Step 3 but does not utilize robust isolation techniques like XML delimiters or specialized escaping for the ingested content.
- Capability inventory: The skill can execute shell and Python commands, commit code to git, push to remote repositories, and interact with the GitHub API to comment on PRs.
- Sanitization: The instructions recommend treating logs as opaque text to avoid shell-level interpolation issues, but no automated sanitization is performed on the data before it is presented to the AI model.
Audit Metadata