finding-on-github
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external, untrusted data from GitHub, creating a surface for indirect prompt injection attacks.
- Ingestion points: The skill uses
git blame,git show,gh search commits,gh issue list, andgh pr list(SKILL.md) to fetch content from public GitHub repositories which can be controlled by external actors. - Boundary markers: The instructions lack delimiters or explicit warnings to the agent to disregard instructions that might be embedded in the fetched issue descriptions, PR comments, or commit messages.
- Capability inventory: The skill utilizes the
gitandghCLI tools (SKILL.md) to interact with the codebase and repository metadata. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from the remote GitHub repositories before it is processed by the agent.
Audit Metadata