github-harvester
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external, untrusted GitHub repositories (issues, discussions, READMEs) and process them for Retrieval-Augmented Generation (RAG).
- Ingestion points: SKILL.md defines a GitHubExtractor class that fetches content via the GitHub API in functions such as get_issues, get_docs, and get_readme.
- Boundary markers: No explicit markers or 'ignore instructions' wrappers are defined in the ingestion pipeline to prevent the agent from following instructions found within the harvested content.
- Capability inventory: The skill performs network reads and file parsing. It does not include direct code execution or file-write capabilities in the harvesting logic, limiting the potential impact of an injection.
- Sanitization: Content is decoded from Base64 as required by the GitHub API, but no specific sanitization is performed to strip potential prompt injections from the harvested text before it is ingested into RAG.
Audit Metadata