github-issues
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it ingests untrusted data from GitHub and possesses local command execution capabilities.
- Ingestion points: Issues, pull requests, comments, and project details containing arbitrary text supplied by external users are fetched via MCP read tools (
mcp__github__issue_read,mcp__github__list_issues) andgh apicalls as described inSKILL.mdandreferences/projects.md. - Boundary markers: Absent. No delimiters or defensive instructions are present to prevent the agent from executing instructions that might be embedded within issue bodies or comments.
- Capability inventory: The skill heavily utilizes local shell command execution (
gh api,gh label,gh issue) across multiple files includingSKILL.md,references/labels.md,references/milestones.md, andreferences/projects.md. - Sanitization: Absent. There is no mention of sanitizing or escaping content retrieved from external repositories before it is processed by the agent or included in output workflows.
Audit Metadata