yds-gh-issue-resolver
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it implements changes based on implementation plans retrieved from GitHub issue comments. A malicious actor with access to comment on an issue could attempt to influence the agent by crafting a plan containing the required marker.\n
- Ingestion points: GitHub issue title, body, and comments retrieved via the
ghCLI tool in Step 1.\n - Boundary markers: The skill identifies the plan using the
<!-- gh-issue-planner:agreed-plan -->marker but does not have instructions to sanitize the content or ignore additional embedded instructions within that plan.\n - Capability inventory: Shell command execution (git, gh), file system modification (implementation), repository test execution, and the invocation of other diagnostic agent skills.\n
- Sanitization: No sanitization or schema validation is performed on the text retrieved from GitHub comments.\n- [COMMAND_EXECUTION]: The skill executes various shell commands for branch management, worktree operations, and Pull Request creation. Most significantly, it executes repository tests in Steps 4 and 8. This represents the execution of repository-resident code, which is a necessary but high-privilege function that could be abused if the repository contents are untrusted or maliciously modified.
Audit Metadata