using-gh-cli
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve reading and acting upon content retrieved from external GitHub repositories, pull requests, and issues.
- Ingestion points: Data enters the agent's context through commands that read external content, such as
gh repo view,gh pr checks, and commands used for reviewing PRs or issues. - Boundary markers: The instructions do not specify the use of delimiters or clear separation between system instructions and the untrusted content fetched from GitHub.
- Capability inventory: The skill utilizes the
ghCLI for significant write operations, including merging PRs, closing issues, and creating new content, which could be triggered by malicious instructions embedded in a PR body or comment. - Sanitization: There is no evidence of sanitization or validation logic to filter out potentially malicious instructions from the retrieved GitHub data before it is processed by the agent.
Audit Metadata