gh
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
gh(GitHub CLI) tool andbashto execute repository management operations. It provides templates for creating branch/tag protection rulesets, managing releases, and handling pull requests via shell commands. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted data from external sources.
- Ingestion points: Commands like
gh pr view,gh issue view,gh release view, andgh ruleset listbring external, user-controlled content (such as issue descriptions, PR bodies, or release notes) into the agent's context. - Boundary markers: The provided instructions do not include specific delimiters or instructions to the agent to treat external content as data rather than instructions.
- Capability inventory: The skill has significant write capabilities, including creating/deleting repository rulesets (
gh api ... --method POST/DELETE), merging PRs (gh pr merge), and creating releases (gh release create). - Sanitization: There is no evidence of sanitization or filtering of the content retrieved from GitHub before it is processed by the agent.
Audit Metadata