lov-gh-contribute
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and skims untrusted files like CONTRIBUTING.md and CODE_OF_CONDUCT.md from external repositories via the GitHub API to determine its contribution rules. This ingestion of external data creates a risk surface where poisoned instructions could influence the agent's behavior. Ingestion points: Remote GitHub repositories fetched in SKILL.md Step 2. Capability inventory: The skill can execute git and gh CLI commands to modify and push to repositories. Sanitization: No explicit sanitization or boundary markers are defined for this external content.
- [COMMAND_EXECUTION]: The skill orchestrates multiple shell commands using git and the GitHub CLI (gh) to manage the fork, branch, commit, and pull request lifecycle.
- [EXTERNAL_DOWNLOADS]: The skill fetches repository metadata and file content from the GitHub API at runtime to inform its operations.
Audit Metadata