eia-github-integration
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation instructions and metadata reference an unverified GitHub repository (
Emasoft/emasoft-integrator-agent) as the source for the skill's markdown and associated automation scripts. - [REMOTE_CODE_EXECUTION]: The skill explicitly instructs the agent to run various Python scripts (e.g.,
sync-projects-v2.py,bulk-label-assignment.py,gh_multiuser.py) usingpythonoruv run python. These scripts are external to the analyzed skill content, meaning their behavior cannot be verified, which introduces a risk of executing arbitrary code if the repository content is compromised. - [COMMAND_EXECUTION]: The skill utilizes shell pipes and the
xargsutility to perform batch operations (e.g., editing multiple issues at once). While the provided examples usejqto filter for numeric IDs, this pattern creates a dependency on external API data from GitHub to construct shell commands, which can be a vector for command injection if input sanitization is bypassed. - [DATA_EXPOSURE]: The skill handles sensitive authentication workflows, including GitHub CLI login and multi-account identity management via SSH keys. While these are documented as standard procedures, the automation of these tasks via unverified external scripts increases the surface area for potential credential exposure.
Audit Metadata