kf-g-github-operations-bot-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and interact with GitHub Issues, Pull Requests, and comments, which are sources of untrusted external data.
- Ingestion points: Issues, PRs, comments, and repository metadata read via the GitHub API (as described in
references/preflight-write-gate.md). - Boundary markers: The skill appends a custom HTML comment marker (
<!-- ai-agent-melumuccu:v1 -->) to its own output viareadMarkedBodyingithub-agent-lib.mjs, but does not implement delimiters or 'ignore' instructions for ingested content. - Capability inventory: Extensive write operations are available, including creating/updating issues and PRs, posting reviews, and resolving threads (implemented across multiple scripts in
sample/scripts/*.mjs). - Sanitization: No evidence of sanitization or filtering of external instructions within the processed GitHub content was found.
- [COMMAND_EXECUTION]: The skill relies on a suite of local Node.js scripts to perform its functions. While most scripts are provided,
sample/README.mdreferences a synchronization script (github-agent-sync-home.mjs) that is missing from the provided skill files, preventing verification of the initial setup logic. - [DATA_EXFILTRATION]: The skill manages highly sensitive credentials, including GitHub Personal Access Tokens (PATs) and GitHub App private keys. While it includes policies to avoid logging these secrets and enforces restrictive file permissions (
chmod 600), the combination of credential access and network capability (via the user-configurableAI_AGENT_GITHUB_API_URLenvironment variable) creates a technical path for data exfiltration if the agent is compromised or redirected to a malicious API endpoint.
Audit Metadata