gh-address-comments
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/fetch_comments.pyexecutes GitHub CLI (gh) commands usingsubprocess.run. While it avoids shell injection by passing arguments as a list, the skill fundamentally depends on executing external binaries. - [DATA_EXFILTRATION]: The skill interacts with GitHub's external APIs to retrieve PR metadata and comments. Although this is the intended functionality, it involves transferring data from the local environment to an external service (GitHub).
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted content from GitHub PR comments.
- Ingestion points: PR comments and review threads retrieved by
scripts/fetch_comments.pyin thefetch_allfunction. - Boundary markers: Absent. The instructions do not define delimiters for the external content provided to the agent.
- Capability inventory: The agent is instructed to 'Apply fixes,' which implies write access to the local filesystem and the ability to execute git or gh commands to push updates.
- Sanitization: The fetched content is processed as raw text without validation or sanitization, allowing embedded instructions to potentially influence agent behavior.
Audit Metadata