github-my-work
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests issue titles and labels from GitHub, which are external sources that could be controlled by third parties. This creates a surface for indirect prompt injection if an attacker places malicious instructions within the issue metadata.\n
- Ingestion points: The skill uses the
gh issue listcommand inSKILL.mdto pull data into the agent's context.\n - Boundary markers: There are no explicit markers or instructions provided to the agent to distinguish issue data from its own instructions.\n
- Capability inventory: The skill environment allows shell execution through the
ghtool.\n - Sanitization: No sanitization or escaping of the ingested strings is performed before processing by the agent.\n- [COMMAND_EXECUTION]: The skill includes instructions to execute shell commands using the GitHub CLI (
gh). These commands are scoped to read-only actions for listing issues and identifying the target repository.
Audit Metadata