github-automation
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub which creates a surface for indirect prompt injection attacks.
- Ingestion points: The agent ingests untrusted content through tools such as
GITHUB_LIST_REPOSITORY_ISSUES(issue bodies/comments),GITHUB_GET_A_PULL_REQUEST(PR descriptions), andGITHUB_SEARCH_CODE(external source code). - Boundary markers: The instructions do not specify the use of delimiters, XML tags, or explicit 'ignore' instructions to prevent the agent from following commands embedded in the retrieved GitHub data.
- Capability inventory: The skill possesses high-privilege capabilities including merging pull requests (
GITHUB_MERGE_A_PULL_REQUEST), triggering CI/CD workflows (GITHUB_CREATE_A_WORKFLOW_DISPATCH_EVENT), and deleting repositories (GITHUB_DELETE_A_REPOSITORY). - Sanitization: No sanitization, filtering, or validation steps are defined for the data retrieved from GitHub before it is processed by the agent.
Audit Metadata