configure-issue-tracker

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes system commands using the gh (GitHub) and git CLI tools to detect repository configuration, verify authentication status, and provision resources.
  • Evidence: Execution of git remote get-url origin in INTERVIEW-GITHUB.md to identify the repository source.
  • Evidence: Execution of gh auth status and various gh api calls in INTERVIEW-GITHUB.md and INTERVIEW-GITHUB-ISSUES-PROJECTS.md to manage resources.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations by calling the GitHub API through the gh CLI to retrieve repository, organization, and project metadata.
  • Evidence: Interactions with official GitHub API endpoints (REST and GraphQL) across multiple interview files.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external data from GitHub and local files to generate configuration files.
  • Ingestion points: Repository metadata from git remote, API responses from gh api (e.g., project titles, organization names), and the existing docs/agents/issue-tracker.md file.
  • Boundary markers: Absent; data is interpolated directly into markdown templates in OUTPUTS.md.
  • Capability inventory: The skill can write configuration files locally (docs/agents/, CLAUDE.md, AGENTS.md) and create/modify GitHub resources (labels, project fields) via the gh CLI.
  • Sanitization: Absent; however, the skill implements a mandatory "Review & Approve" step requiring explicit user confirmation of the proposed actions before execution, which acts as a manual security gate.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 02:09 PM
Security Audit — agent-trust-hub — configure-issue-tracker