github-repo-baseline
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
ghCLI andbashshell to perform repository management tasks. - Evidence: Execution of
gh repo view,gh api, and shell variable assignments inSKILL.md. - Context: These operations are the primary function of the skill and are explicitly described in the documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection by ingesting external data from the GitHub API and user-supplied repository identifiers.
- Ingestion points: The
REPOvariable is populated fromgh repo viewor user input;RULESET_IDis extracted from API responses inSKILL.md. - Boundary markers: No explicit sanitization or delimiters are used for shell variable interpolation in the API paths.
- Capability inventory: The skill has the capability to modify repository settings using
gh api(PATCH, POST, PUT) and read repository data. - Sanitization: JSON responses are parsed using
jq, which prevents some forms of data confusion, but shell variable interpolation remains a surface.
Audit Metadata