github-agent-actions
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill uses
gh apito fetch and decode documentation and configuration files from the official Anthropics GitHub repository to ensure the generated workflows are accurate. These are read-only operations targeting a trusted source.\n- [INDIRECT_PROMPT_INJECTION]: The skill identifies that the resulting workflows will process untrusted data from GitHub events and provides specific implementation guidance to prevent exploitation.\n - Ingestion points: External inputs from
github.eventsuch as pull request titles, issue bodies, and comments are ingested into the workflow context.\n - Boundary markers: The instructions emphasize maintaining a strict boundary between executable code and external data by avoiding direct shell interpolation.\n
- Capability inventory: The generated workflows utilize the
claude-code-actionto perform actions like commenting on PRs and managing issues.\n - Sanitization: The skill explicitly directs the agent to use environment variables (
env:) for all untrusted data instead of direct string interpolation inrun:blocks, effectively preventing shell command injection attacks.
Audit Metadata