openai-gh-address-comments
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes untrusted content from GitHub pull request comments and review bodies, creating a surface for indirect prompt injection. \n
- Ingestion points: The
scripts/fetch_comments.pyscript retrieves data from thebodyfields ofcomments,reviews, andreviewThreadsnodes using the GitHub GraphQL API. \n - Boundary markers: The instructions in
SKILL.mddo not specify any delimiters or safety markers to isolate the fetched comment content from the agent's internal instructions. \n - Capability inventory: The skill is granted access to the
Bash,Read,Grep, andGlobtools, providing the necessary capabilities to modify files or execute system commands based on injected instructions. \n - Sanitization: No sanitization, filtering, or validation is performed on the retrieved comment text before it is presented to the LLM. \n- [COMMAND_EXECUTION]: The script
scripts/fetch_comments.pyusessubprocess.runto interact with the GitHub CLI (gh). While the script correctly uses argument lists to avoid shell injection, it serves as the mechanism for the agent to interact with external GitHub data and the local shell environment.
Audit Metadata