github-workflow-automation
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements multiple workflows that interpolate untrusted external data directly into AI prompts without sufficient isolation or sanitization. Maliciously crafted pull requests, issues, or comments could be used to manipulate the AI's output, potentially affecting labels, review comments, or deployment risk assessments.
- Ingestion points: Pull request diffs (section 1.1), issue titles and bodies (section 2.1), commit logs (section 3.2), and user comments (section 5.1).
- Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present in the prompt templates.
- Capability inventory: The workflows have the ability to create pull request reviews, add labels to issues, post comments, and trigger or fail deployment jobs based on AI analysis.
- Sanitization: No sanitization or filtering of the ingested GitHub event data is implemented before prompt interpolation.
- [DATA_EXFILTRATION]: The provided automation patterns are designed to transmit repository data, including source code diffs, file contents, and commit history, to the Anthropic API for processing. Users should ensure that no sensitive or proprietary data is inadvertently included in pull requests or issues processed by these workflows.
- [EXTERNAL_DOWNLOADS]: The skill references and provides links to external resources, such as the official Google Gemini CLI repository, for further automation patterns.
Audit Metadata