github
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted content from GitHub while maintaining extensive write capabilities. \n
- Ingestion points: Data enters the agent's context through commands like
gh issue view,gh pr view, andgh apifile content retrieval specified inSKILL.md. \n - Boundary markers: The instructions lack specific boundary markers or 'ignore' directives to help the agent separate data from potentially malicious instructions embedded in issue or pull request content. \n
- Capability inventory: The skill provides access to the
Bashtool to perform actions such asgh pr merge,gh secret set, andgh workflow run. \n - Sanitization: There are no requirements or steps provided to sanitize or validate the external data before it is used by the agent. \n- [EXTERNAL_DOWNLOADS]: The skill contains recipes for downloading files from GitHub releases using
gh release download. These downloads are performed from GitHub, which is an established and well-known service.
Audit Metadata