github-labels-query
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches repository label data from the official GitHub REST API via the
ghcommand-line tool. This is a standard operation for repository management and targets a well-known service. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data (label names, colors, and descriptions) from potentially untrusted external repositories.
- Ingestion points: Data enters via the
gh apicommand inquery-labels.sh. - Boundary markers: The skill does not use specific delimiters to isolate label content from agent instructions.
- Capability inventory: The skill uses
gh apifor network requests andjqfor data transformation. - Sanitization: The output is structured as JSON, but the text content of the labels is not sanitized for potential natural language instructions. However, the risk is inherent to tools processing external metadata.
Audit Metadata