tk-github-image-upload-to-pr
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
gh-attachextension for the GitHub CLI. It references the author's forkMTGVim/gh-attachand an upstream versionenthus-appdev/gh-attach. The skill implements a trust preflight that inspectsgh extension listto classify these sources and requires user consent for versions not explicitly reviewed by the author. - [REMOTE_CODE_EXECUTION]: The skill executes remote code by installing and running GitHub CLI extensions. This is managed through strict version pinning (
--pin v0.7.0-mtgvim.1) and user-level authorization for any unreviewed distributions. - [COMMAND_EXECUTION]: The skill executes various system commands including
gh extension list,gh attach,gh auth status,git check-ignore, andgit ls-files. It also uses browser automation through Chrome DevTools Protocol (CDP) and Playwright for the fallback route. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR bodies and comments, creating a potential surface for indirect injection.
- Ingestion points: Reads existing PR bodies and comment content via GitHub API or browser (
SKILL.md,references/gh-attach.md). - Boundary markers: Includes a mandatory "Upload mutation boundary" checkpoint to verify targets, authentication, and requested write scope before modifying state.
- Capability inventory: Can update PR bodies/comments, execute CLI extensions, and perform network operations via browser automation.
- Sanitization: Verifies rendered HTML/page evidence after updates and redacts signed parameters or JWTs from asset URLs.
Audit Metadata