gh-address-comments

Warn

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill contains instructions that direct the agent to bypass platform security sandboxes and escalate execution permissions.\n
  • Evidence: "If sandboxing blocks gh auth status, rerun it with sandbox_permissions=require_escalated" in SKILL.md.\n
  • Evidence: "Run all gh commands with elevated network access" in SKILL.md.\n- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection through the processing of untrusted GitHub PR comments.\n
  • Ingestion points: scripts/fetch_comments.py fetches the body of conversation comments, reviews, and review threads.\n
  • Boundary markers: Absent. No delimiters or instructions are provided to distinguish fetched content from original instructions.\n
  • Capability inventory: The agent has access to file system modification ("Apply fixes") and the GitHub CLI (gh).\n
  • Sanitization: Absent. Comment content is ingested as raw text.\n- [COMMAND_EXECUTION]: The skill executes external commands via a Python script.\n
  • Evidence: scripts/fetch_comments.py uses subprocess.run to call the gh CLI utility for repository interaction.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 6, 2026, 04:52 PM
Security Audit — agent-trust-hub — gh-address-comments