gh-address-comments
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to request "elevated network access" and "escalated permissions" using platform-specific flags like
sandbox_permissions=require_escalatedforghCLI operations (SKILL.md). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted GitHub PR comments, creating an attack surface for indirect prompt injection. Ingestion points: External data is ingested from GitHub PR comments through the execution of
scripts/fetch_comments.py(SKILL.md). Boundary markers: No specific delimiters or markers are defined for the fetched content to prevent the agent from following instructions embedded in comments. Capability inventory: The skill has the capability to execute shell commands via theghCLI and modify local source code to apply fixes (SKILL.md). Sanitization: No content sanitization or validation is described; the skill relies on a user clarification step which may be bypassed or manipulated (SKILL.md). - [COMMAND_EXECUTION]: The skill instructs the agent to execute an external Python script (
scripts/fetch_comments.py) which is not provided in the audited file list, preventing a full security review of its logic (SKILL.md). - [PERSISTENCE]: The
PostToolUsehook is configured to append timestamped logs to~/.claude/gh-address-comments.log. This modifies the user's home directory to maintain a record of activity across sessions (SKILL.md).
Audit Metadata