ci-debug-workflow
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from GitHub issues (
gh issue view) and CI logs to extract reproduction steps. If these sources contain malicious instructions, the agent might execute them using the provided tools. - Ingestion points: GitHub issue content (
references/bug-thread-extraction.md), CI logs (SKILL.md). - Capability inventory:
Bashtool allows for arbitrary command execution (npm, docker, git, etc.). - Boundary markers: None specified in the instructions to separate data from instructions.
- Sanitization: No explicit sanitization or validation of the extracted reproduction steps is mentioned before execution.
- [COMMAND_EXECUTION]: The skill frequently uses the
Bashtool to run builds, tests, and Docker commands (e.g.,npm test,docker build,docker run). While intended for debugging and reproduction of bugs, this capability can be leveraged if the agent is misled by malicious input from external sources. - [DATA_EXFILTRATION]: The instruction to run
env | sortinreferences/ci-patterns.mdis intended for environment verification but can expose sensitive environment variables, tokens, and secrets to the agent's context or output logs if they are stored in the environment.
Audit Metadata