github-actions-inspection
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to ingest and analyze external data from GitHub Action logs, which are controlled by external processes and could contain malicious instructions.\n
- Ingestion points: The skill retrieves workflow logs and job details using commands like
gh run view --logand various GitHub REST API endpoints as documented inSKILL.mdandREFERENCE.md.\n - Boundary markers: The instructions do not specify any delimiters or boundary markers to help the agent distinguish its own instructions from the content of the logs, nor does it warn the agent to ignore instructions embedded within the logs.\n
- Capability inventory: The skill operates in an environment with
Bashandmcp__githubtools, providing the agent with broad execution capabilities and the ability to interact with the GitHub API further based on the data it reads.\n - Sanitization: There is no requirement for the agent to sanitize, escape, or validate the log content before processing, which could allow raw output from a malicious CI job to influence the agent's behavior.
Audit Metadata