github-triage
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on system-level execution of the
gh(GitHub CLI) andgitbinaries to retrieve repository information and perform issue triage actions. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted external data from GitHub issues and comments.
- Ingestion points: Untrusted data enters the agent context via
gh issue viewand comment history (SKILL.md). - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external issue content as untrusted or to ignore instructions embedded within that data.
- Capability inventory: The agent can execute
ghcommands to modify repository state (labels, comments, closing issues) and has the ability to create or modify files in the.out-of-scope/directory. - Sanitization: The instructions do not specify any sanitization or validation of the external content before it is used to generate recommendations or summaries.
Audit Metadata