gh-link-subissues

Pass

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the gh CLI to interact with the GitHub GraphQL API. It provides command templates for retrieving issue Node IDs and performing the addSubIssue mutation. The use of -f and -F flags for parameter passing is a secure practice to prevent injection into the GraphQL query itself.- [EXTERNAL_DOWNLOADS]: The skill identifies the GitHub CLI (gh) as a prerequisite. gh is the official command-line tool from GitHub, which is a well-known and trusted service.- [PROMPT_INJECTION]: An indirect prompt injection surface is present as the skill processes user-supplied input (repository names and issue numbers) for interpolation into shell commands. Ingestion points: User-provided issue identifiers in SKILL.md. Boundary markers: None present. Capability inventory: Shell command execution via the gh CLI. Sanitization: None explicitly defined in the instructions, though the use of CLI flags reduces the risk of malformed input breaking the command structure.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 11, 2026, 03:43 AM