work-backend-qa
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and uses it to guide its execution logic.
- Ingestion points: The skill reads issue descriptions and comments using
gt issue view ISSUE_NUMBER --comments(SKILL.md). - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the issue content as untrusted or to ignore embedded instructions.
- Capability inventory: The agent has the capability to execute shell commands (
gt,mise,wt), access the filesystem across directories (../frontend), and perform browser automation (SKILL.md). - Sanitization: No sanitization or validation of the fetched issue content is performed before the agent processes it to extract criteria and constraints.
- [COMMAND_EXECUTION]: The skill relies on the execution of multiple shell commands to perform its tasks.
- Evidence: Instructions include running
gt issue view,wt list,mise run dev,mise run pw-login, and variousseed:*tasks (SKILL.md). While these are standard for the intended QA workflow, they represent a significant capability tier that could be abused if the agent is misdirected by untrusted input.
Audit Metadata