projects-manager
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs legitimate GitHub Project management tasks using the GitHub CLI and GraphQL API. All operations are consistent with its stated purpose of providing an accessible interface for managing projects and views.- [COMMAND_EXECUTION]: The skill utilizes the 'gh' command-line interface (e.g., 'gh api user') and GraphQL queries/mutations to interact with GitHub services. These operations are essential for the tool's functionality and do not involve unauthorized privilege escalation.- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it processes external data from GitHub Project items.
- Ingestion points: Reads item titles, descriptions, and custom field values from GitHub Projects v2 via the GraphQL API as described in SKILL.md.
- Boundary markers: No explicit delimiters or instructions to treat project data as untrusted are present in the current workflow.
- Capability inventory: The skill can list, create, and update project boards, views, items, and custom field values.
- Sanitization: No specific input sanitization or validation of the ingested GitHub data is defined in the instructions.
Audit Metadata