inbox-open-notification
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Dynamic Command Construction: The skill instructs the agent to execute shell commands such as
open,xdg-open, or the GitHub CLI (gh) using a{url}placeholder. While this is the intended method for opening specific links, it represents a pattern where user-provided input is interpolated into a command line. The agent should be configured to validate that the input provided for{url}is a legitimate URL. - Standard Tool Utilization: The skill relies on established system utilities and the official GitHub CLI. These are well-known tools used for browser interactions and repository management in development environments.
- Indirect Prompt Injection Surface: As the skill processes external data (GitHub URLs) and uses them in command-line arguments, there is a technical surface for indirect prompt injection.
- Ingestion points: External URLs processed from GitHub notifications (referenced in SKILL.md).
- Boundary markers: None explicitly defined for the
{url}variable. - Capability inventory: Uses the
executetool to run shell commands. - Sanitization: No specific sanitization logic is described within the instruction file itself.
Audit Metadata