fork-dev-branch
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection] (MEDIUM): The skill demonstrates a vulnerability to indirect prompt injection by ingests untrusted data from GitHub. * Ingestion points: External data is fetched via
gh issue view <issue-number>inSKILL.md. * Boundary markers: None are used to delimit the external content from the command template. * Capability inventory: The skill executes shell commands usinggit checkout -bandgh. * Sanitization: Includes natural language instructions for the agent to sanitize data (e.g., 'Remove special characters', 'Convert to lowercase'), but lacks programmatic enforcement.- [Command Execution] (MEDIUM): The workflow relies on the agent to correctly format issue titles into branch names before executinggit checkout -b. If an attacker crafts an issue title containing shell metacharacters (e.g., backticks, semicolons) and the agent fails to sanitize them, it could lead to arbitrary command execution in the user's local shell environment.
Audit Metadata