gh-board-sync
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill exclusively uses the official GitHub CLI (gh) to interact with repositories and project boards. All network traffic is directed to GitHub's infrastructure via the user's authenticated CLI session.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub Pull Request descriptions. It mitigates potential injection risks by explicitly instructing the agent to treat this data as untrusted and by using non-executable regex patterns to extract specific issue references.
- [COMMAND_EXECUTION]: Command execution is limited to the GitHub CLI and the local report script. Arguments are handled as arrays in execFileSync, preventing shell injection vulnerabilities.
- [SAFE]: No evidence of obfuscation, hardcoded credentials, exfiltration, or persistence mechanisms was found. The skill follows the principle of least privilege by requiring user confirmation for all mutations.
Audit Metadata