github-image-upload
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill correctly identifies that GitHub pull request and issue bodies are untrusted sources that could contain malicious instructions. It implements a robust mitigation strategy by using shell pipelines and the
--body-file -flag to ensure the untrusted content is passed directly between GitHub CLI commands without returning to the AI agent's processing context. It also recommends the use of boundary markers (<<<UNTRUSTED_BODY) to isolate data. - [COMMAND_EXECUTION]: The skill uses a variety of shell utilities (
printf,cat,grep) to manipulate pull request metadata. It employs defensive shell programming, such as using logical AND gates (&&) and temporary files, to prevent data loss or accidental overwriting of pull request descriptions if a command fails. - [EXTERNAL_DOWNLOADS]: The skill requires a third-party GitHub CLI extension (
drogers0/gh-image). The instructions explicitly forbid the AI agent from installing or upgrading this extension automatically, requiring the user to manually perform these actions, which maintains proper oversight of the environment. - [CREDENTIALS_UNSAFE]: The skill provides documentation on using a high-privilege
user_sessioncookie required for the GitHub upload endpoint. It includes security best practices, such as instructing the agent never to log or store the value and recommending the use of environment variables over command-line arguments to prevent visibility in process monitors.
Audit Metadata