organize-github-repos
Warn
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/check_single_repo.pyis vulnerable to SQL injection because it constructs SQL queries using string interpolation (f-strings) with unvalidated user input. The repository name is taken directly from the command-line argument (sys.argv[1]) and embedded into database queries. - Evidence in
scripts/check_single_repo.py(lines 40-41):query = f"SELECT * FROM repositories WHERE name = '{repo_name}' LIMIT 1". - Evidence in
scripts/check_single_repo.py(lines 115-116):update_query = f"UPDATE repositories SET {', '.join(updates)} WHERE name = '{repo_name}'". - The resulting unsanitized SQL string is passed as input to the
execute_sqltool of the Supabase MCP server. An attacker providing a malicious repository name (e.g.,' OR 1=1; --) could execute arbitrary SQL commands against the database. The skill's ownREADME.mdacknowledges this risk under 'Known Limitations'.
Audit Metadata