triage
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process untrusted content from external issue trackers, including issue descriptions, user comments, and pull request diffs. This data is used to determine the state of an issue and to generate agent briefs, which could allow an attacker to embed malicious instructions that the agent might follow.\n
- Ingestion points: Untrusted data enters the agent's context during the 'Gather context' step in
SKILL.md, where it reads the full issue or PR body and comments.\n - Boundary markers: There are no explicit instructions or delimiters provided to the agent to distinguish between its own instructions and the untrusted data it is processing.\n
- Capability inventory: The skill has the ability to post comments, apply labels, close issues, and read/write files within the repository (specifically in the
.out-of-scope/directory).\n - Sanitization: The skill does not specify any sanitization or validation steps for the content retrieved from the issue tracker before it is used in decision-making or brief generation.
Audit Metadata