create-public-gh-repo
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands including
git,gh(GitHub CLI), and local bash scripts (scripts/scaffold.shandscripts/configure.sh). These operations are used to initialize a git repository, apply file templates, and programmatically set repository configurations via the GitHub API. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential command injection surface where external data is interpolated into shell commands. Specifically, in
SKILL.md(Step 4), the user-provided<description>and the folder-derived<repo>name are placed directly into a shell command:gh repo create <owner>/<repo> --public --description "<description>" --source . --remote origin --push. - Ingestion points: The repository name is taken from the current folder name, and the repository description is provided by the user via natural language input.
- Boundary markers: There are no explicit sanitization or escaping mechanisms shown in the instruction set for these variables before they are passed to the shell.
- Capability inventory: The agent has the capability to execute shell commands, write files, and perform network operations via the GitHub CLI.
- Sanitization: The instructions do not explicitly require the agent to sanitize the input strings for shell metacharacters (e.g.,
;,&,|,`), which could lead to arbitrary command execution if the input is maliciously crafted.
Audit Metadata