github-bot-interaction
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to perform GitHub mutations such as pull request comments and commit messages.
- Ingestion points: Processes repository paths and approved mutation parameters (text, branch names) defined in SKILL.md.
- Boundary markers: Explicitly instructs the agent to restate all repository targets and approved parameters, followed by a mandatory user confirmation step before execution.
- Capability inventory: Performs Git commits and GitHub API writes through the get-bot-gh-token.sh script.
- Sanitization: Relies on human-in-the-loop review and restatement of text-posting actions to prevent unintended execution.
- [DYNAMIC_EXECUTION]: The helper script uses Python to construct authentication tokens and interact with the GitHub API.
- Evidence: The get-bot-gh-token.sh script executes python3 -I -S -c to perform Base64URL encoding, JSON processing, and HTTPS requests. The use of -I -S flags ensures isolation from the user's environment.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill communicates with the official GitHub API to exchange credentials for installation tokens.
- Evidence: Fetches tokens from the well-known endpoint https://api.github.com/app/installations/access_tokens.
- Context: Token handling is ephemeral; the script is designed to print the token only to stdout for immediate consumption by a single Git or API command, preventing persistence in logs or configurations.
Audit Metadata