github-workflow
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read external content such as CI logs and pull request information to perform tasks. This creates a surface where an attacker could embed malicious instructions in GitHub issues or log outputs to influence the agent's behavior.
- Ingestion points: GitHub CI logs, issue metadata, and PR descriptions (referenced in the manual usage instructions).
- Boundary markers: Absent. The instructions do not specify how to delimit external content from system instructions.
- Capability inventory: Use of the GitHub CLI (
gh) to mutate remote repository state, manage releases, and review pull requests. - Sanitization: Absent. No mention of filtering or escaping external data before processing.
- [COMMAND_EXECUTION]: The skill's core purpose is to guide the agent in executing shell commands via the GitHub CLI. While the instructions include restrictions against dangerous flags like
--adminor force-pushing shared branches, the agent is granted the capability to perform significant actions on remote infrastructure based on instructions that could be influenced by external data.
Audit Metadata