gh-address-comments
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule inscripts/fetch_comments.pyto execute GitHub CLI (gh) commands. This allows the skill to fetch metadata and comments for the current pull request. The script implements this safely by using argument lists rather than shell strings, preventing typical command injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from GitHub PR comments, which is untrusted external content.
- Ingestion points: External data is ingested via the
gh api graphqlcommand inscripts/fetch_comments.py(Line 185). - Boundary markers: The skill lacks explicit boundary markers or instructions to treat external comment content as untrusted data within the
SKILL.mdinstructions. - Capability inventory: The agent is empowered to apply code fixes based on the fetched comments and can execute shell commands through the
ghtool viasubprocess.run(Line 115). - Sanitization: There is no evidence of sanitization or filtering of the comment content before it is processed by the agent.
Audit Metadata