github-address-comments
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/fetch_review_threads.pyutilizes thesubprocessmodule to call thegh(GitHub) command-line interface. These executions are scoped to fetching repository information and pull request metadata. The commands are constructed using list-based arguments, which follows best practices to prevent shell injection, though they still constitute direct command execution capabilities. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests untrusted data from GitHub pull request comments that the agent is expected to process.
- Ingestion points: Pull request review comments and issue comments are fetched from the GitHub API using the
scripts/fetch_review_threads.pyscript. - Boundary markers: The skill does not implement clear delimiters or explicit instructions for the agent to ignore potentially malicious commands embedded within the fetched comment content.
- Capability inventory: The skill has capabilities to execute shell commands (via the
ghCLI) and perform file system writes (writing to the resolution log). - Sanitization: The fetched comment bodies are presented to the agent without any visible sanitization, filtering, or transformation to prevent instruction injection.
Audit Metadata