gh-address-comments
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data (GitHub comments) which can lead to indirect prompt injection.
- Ingestion points: Pull request comments, reviews, and threads are fetched from GitHub via
scripts/fetch_comments.pyand provided to the agent context. - Boundary markers: Absent. The instructions do not provide delimiters or warnings to help the agent distinguish between legitimate task descriptions and malicious instructions embedded within the fetched comments.
- Capability inventory: The agent is empowered to "Apply fixes" (file system modification) based on the fetched data and executes shell commands via the
ghCLI (scripts/fetch_comments.py). - Sanitization: Absent. The skill passes fetched content directly to the agent without filtering or validation.
- [COMMAND_EXECUTION]: The script
scripts/fetch_comments.pyutilizessubprocess.run()to executegh(GitHub CLI) commands. While it avoids shell=True and passes arguments as a list to prevent basic command injection, it relies on the execution of external CLI tools with the user's local authentication state. - [PRIVILEGE_ESCALATION]: The
SKILL.mdfile explicitly requests escalated platform permissions (sandbox_permissions=require_escalated) and elevated network access to enable theghCLI to operate outside the default restricted sandbox environment.
Audit Metadata