gh-org-chart
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the
gh(GitHub CLI),jq, andpython3. These are used for their intended purposes: fetching organization data via the GitHub API, processing JSON, and rendering the final HTML report. - [DATA_EXFILTRATION]: While the skill accesses GitHub organization data (teams, members, and repository metadata), this data is stored in the local
${TMPDIR}and is not transmitted to any third-party services. The network operations are limited to the official GitHub API via theghCLI tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (GitHub API and CODEOWNERS files). While this represents a potential attack surface, the risk is low as the data is used primarily for rendering a static HTML visualization and is properly escaped during the rendering process in
render.pyusinghtml_escapefunctions.
Audit Metadata