github
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub, such as repository content, issues, and comments, which presents a surface for indirect prompt injection attacks.\n
- Ingestion points: External data enters the agent context through the
github call-read-toolcommand andmcp.readmethods as specified in the manifest.yaml and SKILL.md files.\n - Boundary markers: There are no specific instructions for the agent to use delimiters or protective framing when processing content from these external sources.\n
- Capability inventory: The skill has write capabilities (e.g., modifying GitHub issues or pull requests) via the
github call-toolcommand, but these actions are limited by a requirement for explicit user approval (manifest.yaml).\n - Sanitization: The skill implements a
response_guardusing verification codes for both read and write operations to mitigate risks (manifest.yaml).
Audit Metadata