project-init
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings (such as project titles and descriptions) and interpolates them directly into shell commands executed via the GitHub CLI. This design creates a vulnerability surface for command injection if the agent does not properly sanitize the input.
- Ingestion points: User input for project title, owner, visibility, and description are gathered in Step 1 and used in subsequent steps.
- Boundary markers: The skill uses double quotes around some template variables (e.g.,
--title "<タイトル>"), but this does not prevent injection if the user input contains balanced quotes and command separators. - Capability inventory: The skill utilizes the
ghCLI to create projects, link repositories, and modify project fields, which requires active command execution capabilities. - Sanitization: There are no instructions provided within the skill for the agent to sanitize, escape, or validate the user-provided data before passing it to the shell.
- [COMMAND_EXECUTION]: The skill relies on executing system commands using the GitHub CLI (
gh) to automate the setup of Project v2 boards, including field creation and repository linking. - [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub's official services and provides URLs to GitHub's web UI for manual configuration of built-in workflows. These references target a well-known service and are part of the intended functionality.
Audit Metadata