orchestrate-multi-repo-sdks
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The provided GitHub Action templates use direct string interpolation of GitHub context variables into shell commands. This pattern is vulnerable to command injection because context variables like
github.head_refandgithub.event.pull_request.head.refcan be manipulated by external contributors through branch names. - Evidence in
SKILL.md(Kick Off workflow):gh workflow run sdk_generation.yaml --repo "your-org/${{ matrix.repo }}" --field feature_branch="${{ github.head_ref }}" - Evidence in
SKILL.md(Reconcile workflow):branch="${{ github.event.pull_request.head.ref }}" - Evidence in
SKILL.md(SDK workflow):git checkout -b "${{ inputs.feature_branch }}" - [INDIRECT_PROMPT_INJECTION]: The skill documents a workflow that ingests untrusted external data (branch names from PRs) into a high-privilege context (CI/CD runner with repository secrets) without sanitization.
- Ingestion points:
github.head_refinkick-off-generation.yaml,github.event.pull_request.head.refinreconcile-prs.yaml, andinputs.feature_branchinsdk_generation.yaml. - Boundary markers: Absent.
- Capability inventory: Includes shell command execution (
gh,git,speakeasy), file system access, and access to theSDK_REPOS_PATandSPEAKEASY_API_KEYsecrets. - Sanitization: Absent. The skill uses direct shell interpolation instead of mapping values to intermediate environment variables.
Recommendations
- AI detected serious security threats
Audit Metadata