configure-issue-tracker
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system commands using the
gh(GitHub) andgitCLI tools to detect repository configuration, verify authentication status, and provision resources. - Evidence: Execution of
git remote get-url origininINTERVIEW-GITHUB.mdto identify the repository source. - Evidence: Execution of
gh auth statusand variousgh apicalls inINTERVIEW-GITHUB.mdandINTERVIEW-GITHUB-ISSUES-PROJECTS.mdto manage resources. - [EXTERNAL_DOWNLOADS]: The skill performs network operations by calling the GitHub API through the
ghCLI to retrieve repository, organization, and project metadata. - Evidence: Interactions with official GitHub API endpoints (REST and GraphQL) across multiple interview files.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external data from GitHub and local files to generate configuration files.
- Ingestion points: Repository metadata from
git remote, API responses fromgh api(e.g., project titles, organization names), and the existingdocs/agents/issue-tracker.mdfile. - Boundary markers: Absent; data is interpolated directly into markdown templates in
OUTPUTS.md. - Capability inventory: The skill can write configuration files locally (
docs/agents/,CLAUDE.md,AGENTS.md) and create/modify GitHub resources (labels, project fields) via theghCLI. - Sanitization: Absent; however, the skill implements a mandatory "Review & Approve" step requiring explicit user confirmation of the proposed actions before execution, which acts as a manual security gate.
Audit Metadata