github-multi-repo
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external repositories, creating an attack surface for malicious instructions embedded in those repositories.
- Ingestion points: Repository content, including package.json and source code, retrieved via gh repo clone and gh api calls.
- Capability inventory: The skill can execute shell commands (npm install, npm test), write to the file system, and perform network operations via the GitHub CLI.
- Boundary markers: No specific delimiters or ignore instructions prompts are used when processing content from managed repositories.
- Sanitization: The skill performs automated synchronization and testing without visible validation of the content being executed from the remote repositories.
- [COMMAND_EXECUTION]: The skill relies heavily on executing shell commands to perform repository operations.
- Evidence: Scripts utilize Bash to invoke gh, git, and npm for cloning, updating, and testing across multiple project directories.
- [EXTERNAL_DOWNLOADS]: The skill fetches external code and dependencies as part of its primary coordination function.
- Evidence: Clones repositories from GitHub and installs Node.js packages. It utilizes ruv-swarm, a tool associated with the vendor, to manage AI swarm orchestration.
Audit Metadata