gh
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from GitHub (issues, PRs, comments, and files) which could contain adversarial instructions.\n
- Ingestion points: External data enters the agent context via
gh search,gh issue/pr list,gh discussion view, andgh repo read-fileinSKILL.md.\n - Boundary markers: The instructions lack guidance on using specific markers or warnings to delimit and ignore instructions within the fetched data.\n
- Capability inventory: The skill exposes high-privilege operations such as creating and editing issues, pull requests, and discussions, as well as file system operations like creating git worktrees.\n
- Sanitization: There are no instructions for sanitizing or validating the content retrieved from GitHub before processing it.\n- [COMMAND_EXECUTION]: The skill documents the execution of various CLI commands that interact with the network and local file system.\n
- Evidence: The skill describes using
gh apifor arbitrary GraphQL and REST requests, andgh pr checkout --worktreefor creating new directories and checking out code.
Audit Metadata