add-community-extension
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and parse untrusted data from user-submitted GitHub issues to extract extension metadata (ID, name, description, repository, etc.). This introduces an indirect prompt injection surface where a malicious extension submission could include instructions designed to hijack the agent pipeline during step-by-step processing.
- [COMMAND_EXECUTION]: The skill uses a
python3command inline to validate the JSON structure ofextensions/catalog.community.json. While the command itself is benign and static, if the JSON parsing logic or file inputs are successfully poisoned via data injection, it could pose a risk depending on structural integrity. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Reads metadata directly from a GitHub issue URL or number provided by users (Step 1).
- Boundary markers: Absent. The skill contains no explicit boundary markers, escaping rules, or guidelines instructing the agent to ignore any natural language instructions embedded within the issue body.
- Capability inventory: Modifies JSON/Markdown files, executes localized verification commands (
python3 -c), and handles git operations (git checkout,git add,git commit,git push) alongside creating Pull Requests via GitHub APIs (Step 4, 5, and 6). - Sanitization: Absent. The procedure relies entirely on manual/agent validation of formatting constraints (Regex for ID, SemVer format for version) but does not validate or sanitize description fields or text areas against embedded text prompt instructions.
Audit Metadata