gh-fix-ci
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a bundled Python script
scripts/inspect_pr_checks.pythat invokes thegitandgh(GitHub CLI) binaries using thesubprocessmodule. While it uses safe argument lists rather than shell strings, it executes commands with the user's local privileges and GitHub authentication state. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub Actions logs, which is a vector for indirect prompt injection. An attacker could potentially cause a CI failure that outputs log messages designed to trick the agent into performing unintended actions during the summarization or fix-planning phase.
- Ingestion points: Untrusted log data is fetched in
scripts/inspect_pr_checks.pyviagh run view --logandgh apicalls to the GitHub Jobs API. - Boundary markers: The skill does not use specific delimiters or instructions to help the agent distinguish between its own instructions and the untrusted log content.
- Capability inventory: The agent can execute scripts, fetch external CI logs, and is instructed to propose and implement code fixes (which requires file-writing capabilities) upon user approval.
- Sanitization: Log snippets are passed directly to the agent without filtering or sanitizing the content for potential malicious instructions.
Audit Metadata