github-inbox
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources.
- Ingestion points: The
scripts/github-inbox-report.mjsscript fetches issue titles, repository names, and labels directly from GitHub via thegh searchcommand. - Boundary markers: The output is printed as a raw list to stdout without specific delimiters or instructions to the agent to ignore embedded commands within the content.
- Capability inventory: The skill allows the agent to execute write operations such as
gh issue edit,gh issue comment, andgh pr review(as described inSKILL.md). - Sanitization: There is no evidence of filtering or sanitization of the fetched issue titles or labels before they are presented to the agent.
- [COMMAND_EXECUTION]: The skill is configured to execute shell commands using
gh,node, andbunas defined in theallowed-toolssection ofSKILL.md. The helper scriptscripts/github-inbox-report.mjsusesexecFileSyncto invoke the GitHub CLI to perform search and triage operations.
Audit Metadata