github-automation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the user to add an external MCP server URL (
https://rube.app/mcp) to their client configuration. This introduces a dependency on a third-party service not managed by the primary platform, which is required for the skill's core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources and possesses powerful administrative capabilities, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through tools like
GITHUB_LIST_REPOSITORY_ISSUES,GITHUB_GET_A_PULL_REQUEST,GITHUB_SEARCH_CODE, andGITHUB_GET_REPOSITORY_CONTENTas described inSKILL.md. - Boundary markers: The instructions do not define specific delimiters or warnings to ignore instructions embedded within the GitHub data being processed.
- Capability inventory: The skill includes tools for sensitive operations such as
GITHUB_MERGE_A_PULL_REQUEST,GITHUB_CREATE_A_WORKFLOW_DISPATCH_EVENT,GITHUB_UPDATE_BRANCH_PROTECTION, andGITHUB_DELETE_A_REPOSITORY. - Sanitization: There are no documented procedures for sanitizing or validating the content retrieved from GitHub before it influences the agent's decision-making process.
Audit Metadata