soia-dev-github-ops
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted content from GitHub Pull Request diffs and repository-specific rule files (e.g., CLAUDE.md, CONTRIBUTING.md). An attacker could embed instructions in these files to manipulate the agent's review verdict or trick it into performing unauthorized actions.
- Ingestion points: The skill pulls data via 'gh pr diff' and 'gh api' for file contents from target repositories.
- Boundary markers: While the skill instructs the agent to separate facts from inferences, it lacks explicit delimiters or instructions to ignore embedded commands within the ingested content.
- Capability inventory: The skill possesses high-impact capabilities including 'gh pr merge', 'gh release create', and the ability to modify repository permissions via 'gh api -X PUT'.
- Sanitization: There are no instructions for sanitizing, escaping, or filtering the external content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill relies on executing system commands via the gh CLI to perform its functions.
- High-impact operations include merging pull requests and modifying repository collaborator permissions.
- The skill incorporates a 'Safety Model' and 'Safety Gate' section requiring explicit user confirmation for these sensitive operations to mitigate the risk of accidental or unauthorized execution.
Audit Metadata