inbox-get-notification-details
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Command Line Interaction: The skill executes
gh apicommands through the terminal to retrieve data. This is the intended way to use the GitHub CLI for fetching thread and comment details within the development environment. - Data Ingestion Considerations: The skill fetches notification and comment text from GitHub, which is a common pattern for notification management. Because this content originates from external users, it represents an ingestion point for untrusted data that the agent then processes.
- Ingestion points: GitHub API responses via
gh apicalls (defined in SKILL.md). - Boundary markers: The instructions do not explicitly define delimiters to separate retrieved comment bodies from other instructions.
- Capability inventory: The skill utilizes the
executetool to run shell commands (SKILL.md). - Sanitization: The skill retrieves raw comment bodies using
--jqwithout specific filtering of potentially executable strings or instruction-like text.
Audit Metadata