github-pr-workflow
Fail
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains shell scripts designed to read and extract authentication tokens from sensitive local credential stores.
- Evidence: SKILL.md contains logic to search for tokens in
~/.hermes/.envand~/.git-credentialsusinggrepandsed. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external CI logs and uses it to drive code modifications, creating a vulnerability to indirect prompt injection.
- Ingestion points: CI failure logs are fetched from the GitHub API using
curland read into the agent's context in SKILL.md and references/ci-troubleshooting.md. - Boundary markers: The skill does not use specific delimiters or instructions to prevent the agent from following malicious commands embedded in log output.
- Capability inventory: The agent is instructed to use
patch,write_file, and git commands based on the analyzed logs. - Sanitization: No sanitization or validation of the log content is performed before the agent processes it to identify fixes.
Recommendations
- AI detected serious security threats
Audit Metadata