autofix
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes the official GitHub CLI (gh) for platform interactions. The associated helper script, scripts/fetch_unresolved_threads.py, uses subprocess.run with argument lists and no shell environment, which is a secure practice that prevents command injection.
- [PROMPT_INJECTION]: The skill is exposed to untrusted data from review comments. Evidence chain: (1) Ingestion point: scripts/fetch_unresolved_threads.py extracts comment bodies from GitHub. (2) Boundary markers: Not explicitly defined in prompt interpolation. (3) Capability inventory: Uses subprocess calls, git operations, and file writing. (4) Sanitization: Constraints require redaction of secrets. The risk of indirect prompt injection is successfully mitigated by a mandatory human-in-the-loop approval process and explicit instructions to disregard arbitrary commands within comments.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets or unauthorized access to sensitive file paths (e.g., .ssh, .aws) were detected. The skill specifically instructs the agent to redact credentials from all outputs.
- [EXTERNAL_DOWNLOADS]: The skill does not perform any unverified remote downloads. It relies on a local Python script and the standard GitHub CLI tool.
Audit Metadata