github
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill includes a 'Reviewing untrusted input' section that explicitly instructs the agent to treat reviewed files as data, not instructions. It specifically warns against ignoring previous instructions or role-play attempts found in external files, which is a security best practice for agents processing untrusted data.
- [COMMAND_EXECUTION]: The skill uses the
ghCLI andjqto read repository state and generate configuration commands. All commands are targeted at the GitHub API (gh api) or local repository metadata. The skill explicitly requires user confirmation before applying any changes or tagging releases. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external repository data (like CODEOWNERS or workflow files). It addresses this risk by implementing boundary markers and explicit instructions to ignore embedded directives in reviewed content, maintaining a low-risk profile for this category.
- [DATA_EXFILTRATION]: Network operations are restricted to the official GitHub API via the
ghtool. No non-whitelisted domains or suspicious data-sending patterns were found. The skill also includes a note for the agent to never paste secrets into the chat.
Audit Metadata