github-stars-organizer
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from GitHub repository metadata. 1. Ingestion points: The skill reads repository names and descriptions from the GitHub Stars page to build a taxonomy and assign lists (documented in SKILL.md and references/algorithm.md). 2. Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present in the prompts when processing these strings. 3. Capability inventory: The skill uses the chrome-cdp tool to create lists and submit repository membership forms on GitHub. 4. Sanitization: There is no evidence of filtering or sanitizing the fetched repository content before the agent uses it for classification planning. An attacker could craft a repository description to trick the agent into misclassifying projects or creating unnecessary lists.
- [COMMAND_EXECUTION]: The skill requires the use of a browser automation tool (chrome-cdp) and access to a local remote debugging port (127.0.0.1:9222). This grants the agent the capability to perform authenticated web actions on behalf of the user within their GitHub session.
- [EXTERNAL_DOWNLOADS]: The skill identifies a dependency on an external repository for the chrome-cdp tool (github.com/pasky/chrome-cdp-skill).
Audit Metadata