github-deep-research
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external, untrusted sources which could contain malicious instructions.
- Ingestion points: Repository READMEs, file contents, issue logs, and PR descriptions are fetched via
scripts/github_api.pyandSKILL.mdworkflows. Web content is retrieved viaweb_fetchduring discovery rounds. - Boundary markers: The skill lacks explicit instructions for the agent to treat ingested data as untrusted or to use markers (e.g., XML tags) to isolate external content.
- Capability inventory: The agent utilizes
web_search,web_fetch, and local script execution, providing a pathway for actions based on injected instructions. - Sanitization: No sanitization or filtering of fetched text is performed before the agent analyzes it.
- [COMMAND_EXECUTION]: The skill workflow involves executing a local Python script (
scripts/github_api.py) with user-supplied arguments for the repository owner and name. This pattern presents a potential command injection surface if the parameters are not correctly escaped by the calling agent.
Audit Metadata