github-agents
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
github/gh-awCLI extension usinggh extension install. The download targets the official GitHub organization, which is a well-known and trusted service. - [COMMAND_EXECUTION]: The skill documents the use of GitHub-specific CLI commands (
gh aw) and MCP tools for issue and pull request management. These are standard operations for interacting with GitHub's agentic ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill identifies that GitHub agents process untrusted data from issue descriptions, PR diffs, and repository configuration files (
AGENTS.md). It provides defensive guidance, such as defining clear acceptance criteria, using 'safe outputs' to sanitize agent actions, and maintaining read-only defaults to mitigate risks associated with processing external content.
Audit Metadata