github-fleet-maintenance
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates and executes a Python script using
concurrent.futures.ThreadPoolExecutorto perform parallel audits of GitHub repositories.\n- [PRIVILEGE_ESCALATION]: The instructions specify executing a local PowerShell script (Get-GitHubFlags.ps1) with the-ExecutionPolicy Bypassparameter, which circumvents system execution policies.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from external repositories. Ingestion points: Reads repository metadata, descriptions, and file contents (manifests, workflows). Boundary markers: No delimiters or instructions to ignore embedded content are used. Capability inventory: Includes GitHub API write access, commit creation, and execution of local shell and Python scripts. Sanitization: No sanitization or validation of the ingested repository data is described.\n- [EXTERNAL_DOWNLOADS]: The provided C++ CI template (templates/ci-cpp-vcpkg.yml) references third-party GitHub Actions, specificallylukka/run-vcpkgandlukka/run-cmake.\n- [COMMAND_EXECUTION]: UtilizesghCLI and PowerShell commands to perform repository inventory, configuration, and security checks.
Audit Metadata