gh-address-comments
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that direct the agent to bypass platform security sandboxes and escalate execution permissions.\n
- Evidence: "If sandboxing blocks gh auth status, rerun it with sandbox_permissions=require_escalated" in
SKILL.md.\n - Evidence: "Run all gh commands with elevated network access" in
SKILL.md.\n- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection through the processing of untrusted GitHub PR comments.\n - Ingestion points:
scripts/fetch_comments.pyfetches the body of conversation comments, reviews, and review threads.\n - Boundary markers: Absent. No delimiters or instructions are provided to distinguish fetched content from original instructions.\n
- Capability inventory: The agent has access to file system modification ("Apply fixes") and the GitHub CLI (
gh).\n - Sanitization: Absent. Comment content is ingested as raw text.\n- [COMMAND_EXECUTION]: The skill executes external commands via a Python script.\n
- Evidence:
scripts/fetch_comments.pyusessubprocess.runto call theghCLI utility for repository interaction.
Audit Metadata