github-pr-workflow

Warn

Audited by Gen Agent Trust Hub on Apr 25, 2026

Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DATA_EXFILTRATION]: The skill contains logic to extract authentication tokens from sensitive local paths, specifically ~/.git-credentials and ~/.hermes/.env. Accessing these files directly to harvest secrets is a high-risk activity that exposes user credentials, even when the data is used for intended interactions with official APIs.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its automated CI log processing. 1. Ingestion points: CI log content fetched from GitHub API (api.github.com). 2. Boundary markers: Absent; the skill instructions direct the agent to 'read failure logs -> understand the error' without defining safety boundaries for the untrusted text. 3. Capability inventory: The skill utilizes file modification capabilities (patch, write_file) and repository management (git commit, git push). 4. Sanitization: Absent; external log data is processed without escaping or validation.
  • [EXTERNAL_DOWNLOADS]: Fetches ZIP archives and log files from GitHub's official API. This is documented and associated with the primary purpose of the skill, targeting a well-known service.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 25, 2026, 12:08 PM
Security Audit — agent-trust-hub — github-pr-workflow