autonomous-dev

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external repository issues and comments, creating a vulnerability surface where a malicious user could attempt to override the agent's instructions.
  • Ingestion points: Instructions in references/autonomous-mode.md describe reading issue bodies and comments via gh issue view and API calls.
  • Boundary markers: The skill includes a 'Security Note' in references/autonomous-mode.md that explicitly directs the agent to ignore contradictory instructions found in issue text.
  • Capability inventory: The agent has extensive permissions, including shell access for git operations, build/test execution, and PR management.
  • Sanitization: The workflow instructs the agent to only apply code changes (patches or branch references) from trusted maintainers and to follow structured sections of the issue body.
  • [COMMAND_EXECUTION]: The workflow relies on a high volume of terminal commands to perform its development tasks.
  • Evidence: SKILL.md and reference files contain numerous shell scripts for managing git worktrees, running package manager commands (npm, bun, yarn, pnpm), and performing build and test suites.
  • Context: These executions are part of the intended purpose of automating a development environment and are documented as such.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:09 PM
Security Audit — agent-trust-hub — autonomous-dev