github-automation
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes untrusted data and has significant system influence.
- Ingestion points: The skill ingests untrusted content from external sources via
GITHUB_LIST_REPOSITORY_ISSUES,GITHUB_SEARCH_CODE, andGITHUB_GET_REPOSITORY_CONTENT. - Boundary markers: There are no instructions or prompt templates provided to delimit external data or instruct the agent to ignore instructions embedded within issues, PRs, or code files.
- Capability inventory: The skill possesses extensive administrative capabilities, including
GITHUB_MERGE_A_PULL_REQUEST,GITHUB_DELETE_A_REPOSITORY,GITHUB_UPDATE_BRANCH_PROTECTION, andGITHUB_ADD_A_REPOSITORY_COLLABORATOR. - Sanitization: The skill lacks specified mechanisms for validating or sanitizing data retrieved from GitHub repositories before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill provides tools for high-impact repository operations that could lead to data loss or unauthorized access if misused.
- Evidence: The skill documentation includes tools for permanent repository deletion (
GITHUB_DELETE_A_REPOSITORY), modifying security settings (GITHUB_UPDATE_BRANCH_PROTECTION), and changing access control (GITHUB_ADD_A_REPOSITORY_COLLABORATOR). Although the skill recommends user confirmation, the presence of these tools in a single context increases the risk of autonomous or coerced misuse.
Audit Metadata