github-cli
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the GitHub CLI (
gh) and the GitHub API viagh apito interact with remote repositories and retrieve metadata. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by encouraging the agent to read and process external data that could contain malicious instructions.
- Ingestion points: Commands like
gh pr view,gh pr diff,gh issue view, and API calls to fetch comments/reviews ingest external, user-provided content from GitHub into the agent's context. - Boundary markers: The instructions do not specify the use of delimiters or boundary markers (e.g., XML tags or clear separators) to isolate external content from system instructions.
- Capability inventory: The agent is empowered to execute shell commands (
gh,git) and perform network operations via the GitHub API. - Sanitization: There are no instructions provided to sanitize, filter, or validate the content retrieved from GitHub before processing it.
Audit Metadata