notification-triage
Pass
Audited by Gen Agent Trust Hub on Nov 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external, untrusted content from GitHub notifications, which represents a potential attack surface for indirect prompt injection.
- Ingestion points: Untrusted data is retrieved from notification subjects, bodies, and comments via
list_notificationsandget_notification_details(SKILL.md). - Boundary markers: The skill contains explicit defensive instructions to treat all notification content as data rather than instructions.
- Capability inventory: The skill has permissions to read notifications, modify notification states (read/done), and manage thread/repository subscriptions.
- Sanitization: Instructions mandate that embedded commands must not influence the agent's task or authorize any write operations.
- [NO_CODE]: The skill does not contain any executable scripts, binaries, or configuration files, consisting only of descriptive instructions.
Audit Metadata