address-github-comments
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub PR and issue comments via the
gh pr view --commentscommand. This represents a vulnerability surface where external actors can embed instructions to manipulate the agent's actions. - Ingestion points:
gh pr view --commentscall inSKILL.md. - Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore instructions embedded within the fetched comments.
- Capability inventory: The skill is designed to apply code fixes and execute shell commands via the GitHub CLI, providing a high-impact target for successful injection.
- Sanitization: Absent. The content is processed directly without filtering or validation.
- [COMMAND_EXECUTION]: The skill invokes the
gh(GitHub CLI) utility to view comments, check authentication status, and post responses. These are legitimate operations for the skill's primary purpose.
Audit Metadata