gh-stack
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from GitHub pull requests.\n
- Ingestion points: Data is ingested from the output of
gh stack view --json, which includes PR titles, bodies, and branch names from the remote repository.\n - Boundary markers: While the skill uses structured JSON for state management, it lacks explicit instructions or delimiters to ignore potential instructions embedded within the PR's natural language fields.\n
- Capability inventory: The skill has the capability to execute shell commands via the
ghandgitCLIs to create, modify, and merge branches and pull requests.\n - Sanitization: There is no evidence of sanitization or filtering of the ingested PR metadata before it is processed or used to influence agent decisions.\n- [EXTERNAL_DOWNLOADS]: The skill setup in
SKILL.mdperforms an external download by installing thegh-stackextension from GitHub via thegh extension installcommand.\n- [SAFE]: All external references and dependencies target the official GitHub organization and its documented tools, which are well-known services.
Audit Metadata