simple-github-cli
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) for API interaction, repository state monitoring, and code search. It specifies that sensitive operations, such as credential management and remote mutations, must be explicitly authorized by the user and suggests providing executable commands for the user to run locally to ensure transparency. - [EXTERNAL_DOWNLOADS]: The skill documentation in
optional-peer-agent-task-relay.mddescribes a process for fetching additional markdown instructions from the vendor's repository on GitHub (porada/domfiles). This fetch operation is targeted at the vendor's own infrastructure and includes validation checks such as full object ID (commit hash) verification. - [INDIRECT_PROMPT_INJECTION]: As the skill processes data from external GitHub resources (e.g., issues, pull requests, and source comments), it acknowledges a potential attack surface for indirect prompt injection. It provides explicit instructions for the agent to treat this data as untrusted and to never let it authorize actions.
- Ingestion points: GitHub response bodies, search results, pull request content, and repository source files.
- Boundary markers: Present; the skill instructs the agent to quote or delimit untrusted content as data.
- Capability inventory: Access to GitHub through
gh api,gh search, and repository management tools. - Sanitization: Present; the skill mandates that untrusted data must not be interpreted as instructions and cannot override existing policies.
- [DYNAMIC_EXECUTION]: The
agent-task-relaymechanism allows for the dynamic loading of peer guidance from remote markdown files, which incorporates external prompt instructions into the agent's execution flow at runtime.
Audit Metadata