gh-stack
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, including Git commit messages, branch names, and GitHub pull request metadata, which could be used to inject malicious instructions into the agent's context.\n
- Ingestion points: The skill instructions (SKILL.md) and command references (references/commands.md) direct the agent to read PR state and commit logs using commands like
gh stack view --jsonandgit log.\n - Boundary markers: The instructions do not specify the use of boundary markers or delimiters to separate untrusted PR content from system instructions.\n
- Capability inventory: The agent is granted the ability to perform significant operations including Git commits, rebases, and pushes, as well as PR creation and merging via the
ghtool.\n - Sanitization: No sanitization or validation steps are outlined for handling the contents of PR titles, bodies, or commit messages.\n- [EXTERNAL_DOWNLOADS]: The skill setup process involves downloading and installing the
gh-stackextension from the official GitHub organization.\n - Evidence: The setup instructions in SKILL.md include
gh extension install github/gh-stack.
Audit Metadata