gh-cli
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is exposed to indirect prompt injection due to its handling of untrusted data from GitHub repositories.
- Ingestion points: The skill instructions in SKILL.md include commands to fetch pull request bodies (
gh pr view), issue content and comments (gh issue view), and raw file contents (gh api .../contents). - Boundary markers: There are no instructions or delimiters provided to ensure the agent ignores potentially malicious instructions embedded within these external data sources.
- Capability inventory: The skill enables high-privilege actions across SKILL.md, including merging pull requests (
gh pr merge), approving reviews (gh pr review --approve), and modifying repository files (gh api ... -X PUTandgit push). - Sanitization: No sanitization, validation, or escaping mechanisms are specified for the data retrieved from the GitHub API before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill is built around the execution of shell-based CLI tools.
- Evidence: SKILL.md relies extensively on the execution of
gh(GitHub CLI) andgitcommands to perform all repository-related tasks.
Audit Metadata