external-campaign-triage
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external maintainer responses and tracker data, creating a surface for indirect prompt injection where malicious instructions could be embedded in maintainer comments.
- Ingestion points: The agent is instructed to read maintainer responses on external GitHub repositories and process JSON records within a campaign tracker repository (SKILL.md).
- Boundary markers: There are no explicit delimiters or "ignore instructions" warnings defined in the skill to wrap the external maintainer content when it is ingested into the agent context.
- Capability inventory: The skill directs agents to perform implementation, open pull requests (using
subagent-pipeline), and post public comments to GitHub, providing a path for injected instructions to trigger outbound actions. - Sanitization: While the skill refers to the
subagent-pipeline's "credential-redaction discipline" for public comments, it lacks internal validation or sanitization rules for the maintainer feedback it processes before state transitions.
Audit Metadata