github-api
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill communicates with non-whitelisted domains including gateway.maton.ai, ctrl.maton.ai, and connect.maton.ai to proxy GitHub requests. It transmits the MATON_API_KEY environment variable to these endpoints as part of its core functionality.\n- [PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its broad read and write capabilities on GitHub repositories.\n
- Ingestion points: Untrusted data is ingested into the agent context via multiple endpoints, specifically GET /github/repos/{owner}/{repo}/contents/{path}, GET /github/repos/{owner}/{repo}/issues, and GET /github/repos/{owner}/{repo}/pulls.\n
- Boundary markers: The instructions do not define delimiters or provide clear guidance to the agent to distinguish between trusted instructions and retrieved repository content.\n
- Capability inventory: The skill provides the agent with powerful capabilities, such as repository deletion (DELETE /github/repos/{owner}/{repo}), file creation/modification (PUT /github/repos/{owner}/{repo}/contents/{path}), and pull request merging, which could be maliciously exploited if the agent obeys instructions embedded in external data.\n
- Sanitization: There is no evidence of data validation, sanitization, or filtering applied to the content retrieved from GitHub before it is processed.
Audit Metadata