github
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from GitHub (e.g., issue descriptions, pull request bodies, and CI logs).
- Ingestion points: Data enters the agent context through commands like
gh pr view,gh issue list,gh run view, andgh apias documented inSKILL.md. - Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between user-provided data and agent instructions.
- Capability inventory: The skill allows the agent to perform write operations such as
gh pr create/merge,gh issue create/close, and arbitrary API calls viagh apias documented inSKILL.md. - Sanitization: There are no explicit sanitization or validation steps mentioned for the content retrieved from external sources.
- [SAFE]: The skill uses the official GitHub CLI (
gh), which is a well-known service. The installation methods (Homebrew and APT) specified in the YAML frontmatter target official package registries and are consistent with standard development practices.
Audit Metadata