github-pr-workflow
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on shell commands like git, gh, and curl to perform its core functions. It also uses inline Python scripts to parse JSON output from the GitHub API, such as when monitoring PR check statuses in Section 4.
- [DATA_EXFILTRATION]: To authenticate API calls, the skill attempts to extract GITHUB_TOKEN values from local files including ~/.hermes/.env and the standard ~/.git-credentials file. While this supports the skill's primary function, accessing sensitive credential storage is a security concern.
- [PROMPT_INJECTION]: The auto-fix workflow in Section 5 introduces an indirect prompt injection surface by having the agent read and act upon external CI log data.
- Ingestion points: The skill reads log files downloaded from GitHub Actions (/tmp/ci-logs/*.txt).
- Boundary markers: No delimiters or safety instructions are used when reading these logs.
- Capability inventory: The skill uses write_file and patch tools to modify repository code based on the log content, followed by git commit and git push.
- Sanitization: No filtering or validation is performed on the log output before it is processed by the agent.
Audit Metadata