gh-link-subissues
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
ghCLI to interact with the GitHub GraphQL API. It provides command templates for retrieving issue Node IDs and performing theaddSubIssuemutation. The use of-fand-Fflags for parameter passing is a secure practice to prevent injection into the GraphQL query itself.- [EXTERNAL_DOWNLOADS]: The skill identifies the GitHub CLI (gh) as a prerequisite.ghis the official command-line tool from GitHub, which is a well-known and trusted service.- [PROMPT_INJECTION]: An indirect prompt injection surface is present as the skill processes user-supplied input (repository names and issue numbers) for interpolation into shell commands. Ingestion points: User-provided issue identifiers inSKILL.md. Boundary markers: None present. Capability inventory: Shell command execution via theghCLI. Sanitization: None explicitly defined in the instructions, though the use of CLI flags reduces the risk of malformed input breaking the command structure.
Audit Metadata