github
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data from GitHub via tools like github_issue_view, github_pr_view, and github_run_view. If an attacker embeds malicious instructions in an issue comment or PR description, the agent might interpret them. \n
- Ingestion points: External content fetched from GitHub repositories (issues, PRs, logs) in SKILL.md.\n
- Boundary markers: Instructions do not explicitly direct the agent to treat fetched tool output as untrusted data using delimiters.\n
- Capability inventory: The github_cli tool allows for repository modifications (comments, PR creation, releases) which could be triggered by injected instructions.\n
- Sanitization: No sanitization of GitHub content is performed before it is added to the agent context.\n- [COMMAND_EXECUTION]: The skill enables the execution of GitHub CLI commands. While it prohibits credential-related subcommands and 'delete' operations, and mitigates shell injection by using array-based arguments, it still grants the agent the ability to perform significant repository actions that could be misused.
Audit Metadata