github-project
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides documentation and workflows for downloading developer tools such as actionlint from official GitHub release pages and templates from the author's own repository (netresearch). These references are documented as standard setup or maintenance steps from trusted and well-known organizations.
- [INDIRECT_PROMPT_INJECTION]: The skill contains workflows that process external repository data, such as issue bodies and pull request titles. It includes dedicated defensive guidelines in references/agentic-workflows.md and references/workflow-bash-patterns.md, instructing the agent to utilize environment variables rather than direct interpolation to prevent command and prompt injection.
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) and Git to perform repository management tasks, including modifying branch protection, enqueuing pull requests, and updating repository settings. This behavior is the primary intended function of the skill, is transparently documented throughout the guides, and follows established security standards.
Audit Metadata