kf-g-github-operations-bot-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads GitHub App credentials and private keys from a local configuration directory (~/.agents/credentials/github/) to authenticate API requests. These credentials are transmitted to the official GitHub API (api.github.com) to perform authorized actions. This is the intended primary function of the skill and is handled via established authentication protocols (JWT and Installation Tokens).
- [COMMAND_EXECUTION]: The skill includes multiple Node.js scripts (e.g., github-agent-comment.mjs, github-agent-create-issue.mjs) that are intended to be executed by the agent to interact with GitHub. These scripts are provided as part of the skill's core functionality.
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it processes data from local files and potentially external GitHub content to post to the API.
- Ingestion points: Content read from the BODY_FILE argument in multiple writing scripts in the sample/scripts/ directory.
- Boundary markers: The scripts prepend a specific HTML comment marker () to the body of the posted content, which aids in identifying agent-authored activity.
- Capability inventory: The skill can perform diverse write operations, including creating issues, posting comments, and managing pull requests via the GitHub REST and GraphQL APIs.
- Sanitization: No explicit content sanitization or escaping of the input body text is performed before transmission to the GitHub API.
Audit Metadata