fetch-milestone-prs
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill retrieves titles, bodies, and labels from GitHub pull requests and saves them to the local file system.
- Security Consideration: If the collected metadata is later used as input for other automated processes or LLM prompts (such as a release notes generator), there is a potential risk that malicious instructions hidden within a pull request body could influence the agent's behavior.
- Evidence Chain: Untrusted data is ingested from the GitHub API in
fetch-milestone-prs.pyand saved to individual JSON files without sanitization or boundary markers. - Command Execution via Subprocess: The script executes the GitHub CLI (
gh) to interact with the repository API. - Security Consideration: The use of
subprocess.runallows the script to interact with the underlying system, which requires trust in the tool's logic and the environment where it executes. - Context: The commands are executed using argument lists rather than shell strings, which effectively mitigates common shell injection vulnerabilities.
- File System Interaction: The skill creates directories and writes multiple JSON files to the disk based on user-provided milestone names and output paths.
- Security Consideration: Automated file creation based on external input requires ensuring that the generated paths remain within the intended workspace boundaries.
- Context: The implementation uses standard library path management to handle directory creation and file writing for PR metadata.
Audit Metadata