gh-batch-runner
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from GitHub issues (titles, bodies, comments) which are used to drive the agent's implementation logic and populate pull requests. \n
- Ingestion points: GitHub Issue data is fetched in Step 1 and Step 2 using
gh api. \n - Boundary markers: There are no explicit instructions or delimiters used to separate untrusted issue content from the agent's system instructions. \n
- Capability inventory: The skill uses
gitfor code modification andghfor creating issues and pull requests. \n - Sanitization: No sanitization logic is provided to ensure that issue content does not contain malicious instructions or shell metacharacters before being used in commands or prompts.\n- [COMMAND_EXECUTION]: The skill generates shell commands using
ghandgitthat include data from issue titles and bodies. If these fields contain shell control characters, they might be executed in the shell context depending on how the agent's tool interface handles argument quoting.
Audit Metadata