github-pr-workflow
Warn
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONINGDYNAMIC_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill programmatically reads sensitive credential files including
~/.hermes/.envand~/.git-credentialsto extract a GitHub authentication token. - [INDIRECT_PROMPT_INJECTION]: The skill implements an automated CI failure fixing loop that ingests and acts upon data from external GitHub Actions logs. This untrusted data source represents a vulnerability surface where an attacker could provide malicious log output to influence the agent's code modifications or API actions.
- Ingestion points:
SKILL.md(automated log download and extraction). - Boundary markers: None present to delimit untrusted log data.
- Capability inventory:
write_file,patch,git commit,git push, and GitHub API write operations. - Sanitization: No sanitization or validation is performed on the ingested log content.
- [METADATA_POISONING]: The author field in the skill metadata is listed as "Hermes Agent", which conflicts with the provided skill author information.
- [DYNAMIC_EXECUTION]: The skill executes Python code snippets at runtime via
python3 -cto parse JSON data retrieved from remote GitHub API endpoints.
Audit Metadata