gh-fix-ci
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/inspect_pr_checks.pyexecutes externalgh(GitHub CLI) andgitcommands usingsubprocess.run. While it follows the best practice of passing arguments as a list (avoiding shell interpolation), it directly incorporates user-provided PR identifiers and comment text into these commands. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external sources (GitHub) that could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Data is fetched from GitHub PR views, issue comments, review threads, and CI action logs in
scripts/inspect_pr_checks.py. - Boundary markers: The script uses text-based headers and separators to structure output, but lacks explicit instructions for the agent to disregard commands embedded within the fetched data.
- Capability inventory: The skill allows the agent to read PR metadata, fetch logs, add comments, and resolve review threads via the
ghtool. - Sanitization: No sanitization or escaping is performed on the content of comments or logs before they are included in the agent's context.
Audit Metadata