create-task
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the GitHub CLI (
gh) to interact with GitHub repositories and projects. It executes commands such asgh issue create,gh issue edit, andgh project item-addto automate task management. - [DATA_EXPOSURE]: The skill includes instructions to check authentication status using
gh auth statusand manages project metadata. This is localized to the user's environment and the targeted GitHub repository, with no evidence of sending sensitive tokens to external third-party servers. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content (titles, bodies, and tags) to generate GitHub issues.
- Ingestion points: User-supplied task details are gathered in
SKILL.md(Step 2). - Boundary markers: None identified in the prompt instructions to isolate untrusted data.
- Capability inventory: Command execution via
ghCLI and file writing to/tmp/create-task-body.mdas described inreferences/github.md. - Sanitization: Not explicitly defined in the instructions, relying on the agent's default handling of shell arguments.
Audit Metadata