Skills
Navigate
skills/shunk031/skills/shunk031-gh-comment-attach-files/Gen Agent Trust Hub

shunk031-gh-comment-attach-files

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/attach_comment_files.py uses subprocess.run to execute external commands including gh (GitHub CLI) for resolving issue/PR metadata and npx @playwright/cli for browser automation. The commands are invoked using argument lists, which prevents shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and execute the @playwright/cli package from the official npm registry. This is a well-known and trusted tool provided by Microsoft for web testing and automation.
  • [DATA_EXFILTRATION]: The skill creates and maintains a persistent browser profile located at ./.playwright-cli/gh-comment-attach-files/profile. This profile stores session data, such as cookies, to allow the agent to interact with GitHub or GitHub Enterprise Server without needing to re-authenticate for every file upload.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 01:14 PM
Security Audit — agent-trust-hub — shunk031-gh-comment-attach-files