gh-issue-planner
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issues and is explicitly instructed to treat certain sections as binding constraints.
- Ingestion points: The skill fetches issue details, labels, and comments using
gh issue viewin Step 1. - Boundary markers: While it identifies sections using
<!-- gh-issue-drafter:scoped-issue -->, it lacks protective boundaries to prevent these sections from containing malicious instructions that override the agent's behavior. - Capability inventory: The skill can read local files (
read_file), search codebases, and perform write operations to GitHub usinggh issue commentandgh apiPOST requests. - Sanitization: There is no evidence of sanitization or validation of the fetched issue content before it is used to generate implementation plans or commands.
- [COMMAND_EXECUTION]: The skill constructs shell commands using
ghCLI, incorporating variables such as issue IDs and repository names. - Evidence: Step 1 and Step 1.5 involve executing
gh issue view <id>andgh apicalls where identifiers are interpolated directly into the command string.
Audit Metadata