gha-security-review
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to audit untrusted repository content, including workflow files and agent-specific configuration files (such as CLAUDE.md and AGENTS.md). This creates an ingestion point where malicious instructions embedded in a third-party pull request could attempt to influence the agent performing the review.
- Ingestion points: The skill reads .github/workflows/*.yml, action.yml, and specific configuration files like CLAUDE.md and AGENTS.md from the target codebase being reviewed.
- Capability inventory: The skill is configured with shell access via the Bash and Task tools, providing a path for potential command execution if an injection is successful.
- Boundary markers: The instructions do not explicitly mandate the use of strict delimiters or specific warnings to ignore instructions within the audited data files.
- Sanitization: There is no mention of sanitization or filtering logic applied to the content read from the target repository before processing.
Audit Metadata