github-md-preview
Warn
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
yusukebe/gh-markdown-previewextension using the GitHub CLI (gh extension install). This downloads and executes code from a third-party repository that is not a recognized well-known service or trusted organization. - [COMMAND_EXECUTION]: The skill invokes shell commands to manage extensions and start a local web server (
gh markdown-preview). These commands interact with the local file system and network. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process local markdown files (such as
README.md) which may contain untrusted data. This content is sent to the GitHub Markdown API for rendering. There is a potential risk if the rendering tool or the local server is vulnerable to specially crafted markdown content.
Audit Metadata