github
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to use the GitHub CLI (
gh) and the GitHub API to perform actions such as merging pull requests, managing labels, and updating reviewers. This provides a capability surface where the agent can influence external repository states based on its analysis of potentially untrusted data. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it is designed to ingest and process data from external GitHub sources that could contain malicious instructions.
- Ingestion points: Untrusted data enters the agent's context through pull request descriptions, branch comparisons, and issue metadata as specified in the core workflow in
SKILL.md. - Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings to help the agent distinguish between external data and its own system instructions.
- Capability inventory: The agent has write-access capabilities through the
ghtool, including the ability to merge PRs and modify repository metadata. - Sanitization: There are no instructions for sanitizing or validating external content before it is processed by the model.
Audit Metadata