triage
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to verify external pull requests by checking out the code and running "relevant tests or commands" as specified in SKILL.md. Since the code and tests originate from an untrusted external contributor, this constitutes arbitrary code execution from an unverified source.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub issues and PRs, including bodies, comments, and diffs (identified in SKILL.md).\n
- Ingestion points: Untrusted data enters the context during the "Gather context" and "Resuming a previous session" phases.\n
- Boundary markers: Absent; there are no instructions to use delimiters or to treat the ingested external text as data rather than instructions.\n
- Capability inventory: The agent has the capability to execute shell commands, write to the filesystem (via .out-of-scope/ updates), and post comments to external trackers.\n
- Sanitization: Absent; the skill does not require validation or filtering of the external content before it is processed or used to drive tool execution.
Audit Metadata