github-pr-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands (
git,gh,curl,unzip) and inline Python scripts (python3 -c) to manage git branches, commits, and pull requests. - [EXTERNAL_DOWNLOADS]: The skill fetches workflow run logs from GitHub's API (
api.github.com) to a temporary directory for analysis. GitHub is a well-known service, and these downloads are standard for the skill's stated purpose. - [PROMPT_INJECTION]: The skill implements an 'Auto-Fix Loop Pattern' where the agent reads CI failure logs and uses that content to apply code fixes via
patchorwrite_filetools. This creates an indirect prompt injection surface: - Ingestion points: External CI log files (
/tmp/ci-logs/*.txt) downloaded from GitHub actions (SKILL.md). - Boundary markers: The instructions do not specify boundary markers or 'ignore' instructions when the agent reads the log content.
- Capability inventory: The skill encourages the use of
write_file,patch, andgit push, granting the agent the ability to modify the repository based on log content. - Sanitization: There is no explicit sanitization or validation of the log content before it is processed by the agent.
Audit Metadata