rightcode-skill-updater
Warn
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches skill definitions, markdown files, and scripts from external GitHub repositories (mattpocock/skills and awesome-skills/code-review-skill).
- [COMMAND_EXECUTION]: The included Python scripts (check.py and apply.py) use the subprocess module to execute GitHub CLI commands (gh) for repository interaction and API calls.
- [REMOTE_CODE_EXECUTION]: The skill automates the download and local creation of executable files, such as .py and .sh scripts, from external GitHub repositories into the agent's workspace. This facilitates the execution of unverified code introduced from external sources.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and processing untrusted instructions from external GitHub repositories with insufficient validation.
- Ingestion points: Untrusted data enters the agent context via GitHub Content API calls in
scripts/check.pyandscripts/apply.py. - Boundary markers: The skill does not implement delimiters or warnings to instruct the agent to ignore instructions embedded within the downloaded content.
- Capability inventory: The
scripts/apply.pyscript possesses file system access, including the ability to create directories and write files (pathlib.Path.write_text) to the skill directory, which could be used to overwrite existing logic. - Sanitization: Sanitization is limited to a regular expression that replaces the 'name' field in YAML frontmatter; the majority of the file content, including instructions and script bodies, is written to the filesystem without verification.
Audit Metadata