triage
Fail
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md direct the agent to "check it out, run the relevant tests or commands" when verifying external pull requests. This allows for the execution of arbitrary, potentially malicious code from untrusted contributors.
- [COMMAND_EXECUTION]: The agent is given authority to execute shell commands to verify claims within pull requests, creating a direct pathway for a malicious contributor to compromise the host environment.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from issue descriptions and PR comments without using boundary markers or instructions to ignore embedded commands.
- Ingestion points: Issue bodies and PR comments (SKILL.md).
- Boundary markers: Absent.
- Capability inventory: Command execution, filesystem access, and issue tracker interaction.
- Sanitization: None identified.
- [DATA_EXFILTRATION]: Given the capability to execute commands as part of the PR verification workflow, an attacker could include code in a pull request designed to exfiltrate sensitive project data, environment variables, or credentials.
Recommendations
- AI detected serious security threats
Audit Metadata