issue-progress-tracking
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses direct shell interpolation of the
$ARGUMENTS[0]variable in bothSKILL.mdandrules/start-work-ceremony.md. Commands such asgh issue edit $ARGUMENTS[0]andgit checkout -b issue/$ARGUMENTS[0]lack visible sanitization within the skill logic, creating a surface for command injection if the input is not strictly validated by the underlying agent platform. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external GitHub issues which serve as untrusted data sources that can be manipulated by malicious actors.
- Ingestion points: The skill consumes issue identifiers via
$ARGUMENTS[0]and references issue content during comment and PR creation phases. - Boundary markers: No explicit delimiters or boundary instructions are used to separate trusted skill instructions from untrusted data retrieved from the GitHub API.
- Capability inventory: The skill utilizes the
Bashtool to perform authenticated network operations via the GitHub CLI and local file system modifications via git. - Sanitization: There is no evidence of input validation or output escaping implemented to prevent malicious instructions in issues from influencing the agent's behavior.
Audit Metadata