inbox-triage
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh api) to fetch notifications and resolve pull request URLs. It also executes a local script (./notify) to send alerts to the user based on filtered results. These actions are restricted to the intended functionality of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (GitHub PR titles and repository names) and stores it in persistent memory files (
memory/MEMORY.md,memory/topics/inbox-triage.md). This creates a surface where malicious strings in a PR title could influence future agent actions when these files are read. - Ingestion points: GitHub notification API fields (
subject.title,repository.full_name) extracted in Step 1. - Boundary markers: Absent; notification content is written directly to markdown templates.
- Capability inventory: Shell execution of the local
./notifyscript (Step 8) and GitHub API interaction viagh(Step 5). - Sanitization: Absent; content is used directly in string interpolation.
Audit Metadata