github-automation
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements strong credential security by explicitly instructing the agent never to request, print, or persist GitHub authentication tokens in prompts or artifacts.
- [SAFE]: The instructions mandate a "Repository Policy Gate," requiring the agent to verify branch protection rules, required checks, and repository-native commands before performing any state-changing operations.
- [SAFE]: The skill enforces integrity for pull request operations by requiring the agent to bind review decisions to the full head SHA and re-verify the repository state immediately before merging.
- [PROMPT_INJECTION]: The skill identifies an inherent surface for indirect prompt injection by processing external data from GitHub (e.g., issue comments, pull request descriptions, and Action logs).
- Ingestion points: External metadata and content such as PR bodies, comments, and failed job logs accessed via the Rube MCP (SKILL.md).
- Boundary markers: The skill does not define specific delimiters to isolate untrusted data from the agent's instructional context.
- Capability inventory: The skill provides broad write access, including merging code, modifying repository permissions, and dispatching workflows (SKILL.md).
- Sanitization: The instructions do not specify methods for escaping or validating external content before it is processed by the agent.
Audit Metadata