fetch-github-issues
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
gh(GitHub CLI) tool to verify authentication status and retrieve issue data from a specified repository. This is the primary function of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issue bodies, which creates a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted content enters the agent's context through the
gh issue listcommand output, specifically thebodyfield of GitHub issues retrieved at runtime. - Boundary markers: The skill uses Markdown headers (e.g.,
## #<number>) to structure the output, but it does not provide explicit instructions to the agent to treat the issue content as untrusted data or to ignore any embedded instructions. - Capability inventory: While the skill itself is read-only using the
ghtool, the agent may possess other capabilities (such as file system access or shell execution) that could be targeted by malicious instructions contained within a processed issue body. - Sanitization: No sanitization, escaping, or filtering is performed on the retrieved issue content before it is rendered for the agent's consumption.
Audit Metadata