gh-project-board
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
ghcommand-line tool to interact with GitHub Projects and executes a bundled Node.js script (setup-gh-project-board.mjs) for project normalization. - [DATA_EXFILTRATION]: The skill fetches metadata from the user's GitHub projects, including project titles, field names, and select options, to perform audits and suggest normalization plans.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: External data is ingested from the GitHub API, specifically project titles and field configuration labels (file:
scripts/setup-gh-project-board.mjs). - Boundary markers: Not present; the script treats GitHub data as authoritative for the purposes of comparison, though results are presented to the user for review.
- Capability inventory: The script has the capability to modify project fields via the GitHub GraphQL API using the
ghCLI (file:scripts/setup-gh-project-board.mjs). - Sanitization: The script uses
JSON.stringifyto escape and sanitize string values before they are interpolated into GraphQL mutations, which prevents malformed query injection.
Audit Metadata