gh-issue-fix-flow
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest external, untrusted data from GitHub issues and comments.
- Ingestion points: Workflow step 1 (Intake and issue context) uses
gh issue view <id> --repo <owner/repo> --commentsto read potentially attacker-controlled content. - Boundary markers: There are no explicit instructions to treat comments as data or to ignore instructions embedded within the issue text.
- Capability inventory: The skill utilizes powerful capabilities including file system modification, build and test execution via
XcodeBuildMCP, andgit pushoperations. - Sanitization: No sanitization or filtering mechanisms for the ingested text are described.
- [COMMAND_EXECUTION]: The skill utilizes several local command-line tools and MCP-based build tools to perform its tasks.
- Tools used:
gh(GitHub CLI),rg(ripgrep),sed,git, andXcodeBuildMCP(for building and testing code). - Usage: These tools are used for their intended purpose in a developer workflow (searching code, reading files, building projects, and pushing commits).
Audit Metadata