report-bug-issue
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform system environment checks and interact with the GitHub CLI.
- It verifies authentication status using
gh auth status. - It retrieves plugin version information from
~/.claude/plugins/installed_plugins.jsonand tool versions usingclaude --version. - It collects system metadata using
uname -a. - It submits the final report to the vendor-owned repository
VitaDynamics/vita-cc-marketusinggh issue create. - [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by incorporating user-provided text into a shell-executed command.
- Ingestion points: User input is collected via multiple
AskUserQuestionprompts in Step 2. - Boundary markers: The input is interpolated into a Markdown template which is then passed as a string variable to the
ghcommand; no explicit escaping instructions are provided to the agent. - Capability inventory: The skill possesses the
Bashcapability, allowing for command execution. - Sanitization: No explicit sanitization or validation of the user-provided content is performed before it is included in the shell command body.
Audit Metadata