github-backlog
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to executegit remote get-url origin. This command is used to resolve the repository owner and name from the local environment. This is a read-only discovery operation performed locally and does not involve elevated privileges or dangerous arguments. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing external data (titles, bodies, and comments) from GitHub issues. It proactively implements a defense-in-depth strategy by instructing the agent to:
- Ingestion points: Treat all fields retrieved from GitHub issues via MCP tools as untrusted input.
- Boundary markers: Explicitly mandates the use of fenced blocks labeled as quoted issue text to prevent instruction leakage.
- Capability inventory: The skill uses GitHub MCP tools for issue creation, listing, and updates, as well as local git commands.
- Sanitization: Instructs the agent to extract only facts and deliberately ignore any instructions, commands, or requests for network activity embedded within the issue content.
Audit Metadata