github-workflow-automation
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements several workflows where untrusted data from GitHub is processed by an AI agent to perform automated tasks.
- Ingestion points: PR diffs in
ai-review.yml, issue bodies inissue-triage.yml, commit messages indeploy.yml, and comment bodies inmention-bot.yml. - Boundary markers: The prompt templates (e.g., section 1.1 and 5.1) interpolate external data directly into the prompt without visible delimiters or instructions for the AI to ignore embedded commands.
- Capability inventory: The skill can create PR reviews, add labels to issues, post comments, fail CI/CD builds based on 'risk assessment', and perform Git operations (rebases/cherry-picks).
- Sanitization: There is no evidence of sanitization or escaping of the ingested data before it is sent to the AI model.
- [DYNAMIC_EXECUTION]: The 'Smart Cherry-Pick' logic (section 4.2) describes a pattern where an AI model generates resolutions for Git merge conflicts which are then automatically applied to the codebase.
- Evidence: The code snippet
const resolution = await ai.resolveConflict(conflict); await applyResolution(conflict.file, resolution);suggests that AI-generated content is treated as executable code logic that modifies the repository state.
Audit Metadata