github-notification-triage
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch, classify, and report on GitHub notifications, issues, and pull requests. This workflow involves ingesting untrusted data from external contributors which may contain malicious instructions intended to manipulate the agent's behavior during the triage process.
- Ingestion points: Data is ingested from GitHub notifications, issue descriptions, and pull request content as specified in the
item-card-contract.mdtemplate. - Boundary markers: The skill lacks explicit boundary markers or instructions for the agent to ignore potential commands embedded within the fetched notification summaries.
- Capability inventory: The agent is granted
Bash,Read, andWritepermissions. It is specifically instructed to execute a local Python triage script and perform Git operations (git status). - Sanitization: No evidence of sanitization, escaping, or filtering of the external GitHub content is provided in the instructions or reference contracts.
Audit Metadata