gh-fix-pr
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PRs, which could contain malicious instructions designed to influence the agent's behavior during the fix implementation phase.\n
- Ingestion points:
scripts/inspect_pr_checks.pyretrieves review comments, issue comments, and CI log files via GitHub API calls.\n - Boundary markers: The skill's instructions lack explicit boundary markers or directives to distinguish between instructions and data when processing these external inputs.\n
- Capability inventory: The agent has broad permissions within the local repository, including file modification, code execution, and the ability to commit and push changes.\n
- Sanitization: No sanitization or filtering logic is applied to the retrieved comments or logs before they are presented to the agent for analysis.\n- [COMMAND_EXECUTION]: The bundled Python script
scripts/inspect_pr_checks.pyexecutes system commands to interact with the repository and GitHub.\n - The script invokes
ghandgitbinaries usingsubprocess.runwith list-based arguments. While this avoids common shell injection vulnerabilities, the logic grants the agent significant autonomy to perform repository operations using the user's active credentials.
Audit Metadata