github-automation
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes external content from GitHub repositories.
- Ingestion points: Data enters the agent's context through tools like
GITHUB_LIST_REPOSITORY_ISSUES,GITHUB_GET_A_PULL_REQUEST, andGITHUB_GET_REPOSITORY_CONTENT(defined inSKILL.md). - Boundary markers: The instructions in
SKILL.mddo not explicitly mandate the use of delimiters or 'ignore embedded instructions' warnings when reading content from issues or code. - Capability inventory: The agent has access to high-privilege tools in
SKILL.md, includingGITHUB_MERGE_A_PULL_REQUEST,GITHUB_DELETE_A_REPOSITORY, andGITHUB_CREATE_A_WORKFLOW_DISPATCH_EVENT. - Sanitization: There is no mention of input validation or sanitization for the data retrieved from GitHub in
SKILL.md. - Mitigation: The skill includes clear instructions to require explicit user confirmation for destructive actions (merge, delete) and to verify CI status before merging, which serves as a primary defense against automated exploitation.
Audit Metadata