app-review
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from GitHub issues (
gh issue view). The parsed fields (name, url, description, etc.) are controlled by external users and are used to construct shell commands and environment variables.\n - Ingestion points: GitHub issue body, author, and title via
gh issue view $ISSUE_NUMBER --json body,author,title.\n - Boundary markers: Absent. There are no delimiters or 'ignore' instructions specified to prevent the agent from following instructions embedded in the issue content.\n
- Capability inventory: The skill possesses significant capabilities, including shell execution, repository modification (
git add/commit/push), and pull request creation (gh pr create).\n - Sanitization: Not specified in the instructions. User-provided data is directly interpolated into shell strings like
git commit -m "Add NAME to CATEGORY".\n- [COMMAND_EXECUTION]: The skill uses local Node.js scripts (.github/scripts/app-prepend-row.js,.github/scripts/app-update-readme.js) and GitHub CLI tools to perform its tasks. While these are part of the repository infrastructure, their execution is driven by untrusted input derived from the parsed issue fields.
Audit Metadata