agent-github-modes
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines multiple workflows that ingest untrusted external data and interact with execution capabilities, creating a potential indirect prompt injection surface.
- Ingestion points: External text from GitHub is pulled into the agent context via workflows like
pr-manager,issue-tracker,code-reviewer, andsecurity-guardianwhich analyze pull requests, issues, and source code (SKILL.md). - Boundary markers: There are no explicit boundary markers or system instructions to enforce strict separation or tell the model to ignore embedded instructions within incoming GitHub descriptions or comments.
- Capability inventory: The skill has access to full
Bashexecution, file operations (Write), and dynamic agent orchestration tools (mcp__claude-flow__task_orchestrate) specified in the frontmatter ofSKILL.md. - Sanitization: There is no description of data validation or input sanitization mechanisms to neutralize malicious payloads hidden inside repository data.
Audit Metadata