autonomous-dev
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external repository issues and comments, creating a vulnerability surface where a malicious user could attempt to override the agent's instructions.
- Ingestion points: Instructions in references/autonomous-mode.md describe reading issue bodies and comments via
gh issue viewand API calls. - Boundary markers: The skill includes a 'Security Note' in references/autonomous-mode.md that explicitly directs the agent to ignore contradictory instructions found in issue text.
- Capability inventory: The agent has extensive permissions, including shell access for git operations, build/test execution, and PR management.
- Sanitization: The workflow instructs the agent to only apply code changes (patches or branch references) from trusted maintainers and to follow structured sections of the issue body.
- [COMMAND_EXECUTION]: The workflow relies on a high volume of terminal commands to perform its development tasks.
- Evidence: SKILL.md and reference files contain numerous shell scripts for managing git worktrees, running package manager commands (npm, bun, yarn, pnpm), and performing build and test suites.
- Context: These executions are part of the intended purpose of automating a development environment and are documented as such.
Audit Metadata