github-automation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting and acting upon data from external GitHub sources.
- Ingestion points: The skill retrieves untrusted data via tools such as
GITHUB_LIST_REPOSITORY_ISSUES,GITHUB_GET_A_PULL_REQUEST,GITHUB_SEARCH_CODE, andGITHUB_GET_REPOSITORY_CONTENTas described inSKILL.md. - Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore embedded instructions in the fetched data, though they do mandate explicit user confirmation for operations like merging or deleting.
- Capability inventory: The skill has significant capabilities including creating issues (
GITHUB_CREATE_AN_ISSUE), merging pull requests (GITHUB_MERGE_A_PULL_REQUEST), deleting repositories (GITHUB_DELETE_A_REPOSITORY), and triggering CI/CD workflows (GITHUB_CREATE_A_WORKFLOW_DISPATCH_EVENT). - Sanitization: There is no mention of sanitizing, filtering, or escaping the external content retrieved from GitHub before it is processed by the agent.
Audit Metadata