gh-project-sync
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script located at
scripts/gh_project_sync.pyand theghCLI to interact with the GitHub API. It uses a template for passing user-supplied arguments to the script:python3 "$SCRIPT" sync --args-raw "<<USER_ARGS>>". This involves shell command execution and argument interpolation.\n- [EXTERNAL_DOWNLOADS]: The skill requires theghCLI and thePyYAMLPython package to be present on the host system, as specified in the required tools check inSKILL.md.\n- [PROMPT_INJECTION]: An indirect prompt injection surface is present because the skill fetches data from external GitHub Project boards (untrusted external data) and processes it to update local YAML files or post comments/updates back to the GitHub board.\n - Ingestion points: Reads GitHub Project V2 item lists, field lists, and individual item views using the
ghtool (SKILL.md).\n - Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious instructions embedded in card titles, bodies, or PR URLs being synced.\n
- Capability inventory: The skill possesses the ability to read and write local files (
tasks.yml), execute shell commands (gh), and perform network operations via the GitHub CLI (SKILL.md).\n - Sanitization: No sanitization, escaping, or validation of the content retrieved from GitHub is described in the skill's instructions or the script's logic summary.
Audit Metadata