notifications-manager
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
gh apicommand-line tool to perform actions such as listing, filtering, and marking notifications as read. This is the intended purpose of the skill and does not involve arbitrary command execution. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests untrusted data (notification titles, repository names, and issue/PR details) from the GitHub API.
- Ingestion points: Notification data fetched via
gh apiand presented to the user/agent. - Boundary markers: None explicitly defined in the skill instructions to separate notification content from agent instructions.
- Capability inventory: The skill can perform batch operations like marking all read or unsubscribing from threads based on the processed content.
- Sanitization: No explicit sanitization or validation of the notification text is mentioned in the skill definition.
Audit Metadata