gh-address-comments
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing the GitHub CLI (
gh) and a local Python script (scripts/fetch_comments.py) to retrieve pull request data. These commands are executed usingsubprocess.runwith argument lists, which is a secure practice that prevents shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub PR comments and reviews, which could potentially contain malicious instructions.
- Ingestion points: The
scripts/fetch_comments.pyscript retrieves thebodyfield of comments, reviews, and review threads from the GitHub GraphQL API. - Boundary markers: While no formal delimiters are used, the skill instructions include a manual review step where the agent must summarize findings and ask the user for confirmation before applying any fixes.
- Capability inventory: The agent is granted the capability to "Apply fixes" (write code) based on the content of these comments.
- Sanitization: The script does not perform explicit sanitization of the comment bodies before they are printed to the agent's context.
Audit Metadata