github-agentic-workflows
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents workflow patterns that ingest untrusted content from GitHub issues and pull requests, creating a surface for indirect prompt injection attacks.\n
- Ingestion points: Examples in
SKILL.md(e.g., Issue Triage, Security Review) ingest${{ github.event.issue.body }}and pull request data.\n - Boundary markers: Natural language instructions in the examples do not demonstrate the use of delimiters to isolate untrusted data from instructions.\n
- Capability inventory: The framework leverages toolsets for
issues,labels, andpull-requestswhich allow modifying repository state.\n - Sanitization: No explicit prompt-level sanitization or filtering logic is demonstrated within the template examples.\n- [COMMAND_EXECUTION]: The documentation describes the installation and manual execution of the
gh-awCLI extension and the use of abash:tool for executing shell commands within workflows.\n- [EXTERNAL_DOWNLOADS]: The skill fetches toolsets and documentation from official GitHub domains and repositories, including installation of the CLI extension and fetching community workflows via theadd-wizardcommand.\n- [DYNAMIC_EXECUTION]: Example 5 inSKILL.mdillustrates the use ofsafe-inputsto define custom JavaScript functions that are executed at runtime within the agent's context.
Audit Metadata