github-pr-query
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script to execute the
ghandjqbinaries. All user-supplied arguments (repo, state, limit, jq filter) are encapsulated in double quotes within the shell script to prevent command injection attacks.\n- [EXTERNAL_DOWNLOADS]: The script retrieves pull request data from GitHub's servers via the officialghcommand-line tool. This interaction is restricted to GitHub's infrastructure and is necessary for the skill's documented purpose.\n- [DATA_EXFILTRATION]: The script retrieves PR metadata including titles, numbers, and authors. No evidence was found of sensitive data access (e.g., secrets or private keys) or transmission of data to unauthorized third-party domains.
Audit Metadata