rjv-github-image-upload
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs the
gh-imageextension from an external third-party GitHub repository (drogers0/gh-image). - [CREDENTIALS_UNSAFE]: The skill relies on the
user_sessioncookie orGH_SESSION_TOKENenvironment variable. The instructions explicitly state that this credential grants full account access, which is a higher risk than scoped Personal Access Tokens (PATs). - [COMMAND_EXECUTION]: The skill performs shell operations to install software (
gh extension install) and modify GitHub repository content (gh pr edit,gh issue comment), which could be leveraged for unauthorized modifications if the inputs are not properly controlled.
Audit Metadata