gh-fix-ci
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of system commands through the GitHub CLI (
gh) and Git. The bundledscripts/inspect_pr_checks.pyusessubprocess.runto automate these interactions. While the script correctly uses argument lists rather than shell strings, the overall workflow involves executing commands based on PR numbers and URLs provided by the user or discovered at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill ingests logs from GitHub Actions, which may contain output from untrusted code (e.g., tests in a community PR). This content is summarized and used as the basis for code generation and implementation.
- Ingestion points: CI logs retrieved via
gh run view --logorgh apicalls inscripts/inspect_pr_checks.pyandSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the log data are used when presenting findings to the agent.
- Capability inventory: The skill is designed to write to the file system (implementing fixes) and execute commands (
gh,git,python). - Sanitization: The Python script filters logs for failure keywords like 'error' or 'panic', but it does not escape or sanitize the resulting text to prevent instructions within the logs from influencing the agent's behavior.
Audit Metadata