maintainer-triage
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external GitHub pull requests and issues (descriptions, comments, and diffs) which could contain adversarial instructions intended to influence the agent's behavior.
- Ingestion points: Data is fetched via
gh pr viewandgh pr diffinSKILL.md(Step 2). - Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands when processing the external PR/Issue content.
- Capability inventory: The skill has the ability to execute GitHub actions including
gh pr review,gh pr merge, andgh pr close(Step 6). - Sanitization: There is no explicit sanitization or filtering of the external content mentioned, although the workflow requires human approval for each action (Step 4), which serves as a primary control.
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) to perform repository management tasks and administrative actions such as approving CI runs and merging code. The instructions specifically suggest running these commands with the sandbox disabled due to TLS restrictions, which places higher reliance on the agent's integrity and user oversight.
Audit Metadata