gh-address-comments
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/fetch_comments.pyexecutes theghCLI viasubprocess.runto interact with GitHub repositories. While the implementation uses argument arrays to mitigate direct command injection within the script itself, the skill relies on the host system's authenticated GitHub environment and requests escalated sandbox permissions to function correctly. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from GitHub Pull Request comments and instructs the agent to apply code fixes based on that content.
- Ingestion points: Pull Request comments, review bodies, and inline thread content are fetched via the GitHub GraphQL API in
scripts/fetch_comments.py. - Boundary markers: Absent. The
SKILL.mdinstructions do not provide the agent with specific delimiters or instructions to treat the ingested comment content as untrusted data. - Capability inventory: The skill instructions in
SKILL.mdauthorize the agent to "Apply fixes," which grants the capability to perform file system modifications and potentially execute additional shell commands for testing or building. - Sanitization: No filtering or validation is performed on the retrieved comment text before it is presented to the agent for evaluation and action.
Audit Metadata