gh-issue-workflow

Warn

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to execute a shell script located at .uzys-agent-harness/check-absence.sh within the references/hierarchy.md file. The script is invoked with shell commands passed as arguments, which involves dynamic execution of local logic that may not be part of the core skill package.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates by reading and following instructions from external GitHub issue bodies and comments, creating a vulnerability to indirect injection.
  • Ingestion points: Data is ingested through gh issue view <N> --comments and gh issue list as defined in SKILL.md and references/hierarchy.md.
  • Boundary markers: The skill instructs the agent to treat comments as the source of truth for decisions, with instructions to promote these decisions to the issue body, but lacks technical delimiters or "ignore embedded instructions" warnings for the content being processed.
  • Capability inventory: The skill possesses broad capabilities including writing to GitHub issues, milestones, labels, and projects, as well as cloning and pushing to GitHub Wiki repositories.
  • Sanitization: No sanitization or validation of the content retrieved from GitHub is specified before the agent acts upon it.
  • [COMMAND_EXECUTION]: The skill makes extensive use of CLI tools including gh and git to perform remote operations. This includes creating and modifying issues, managing project boards, and performing administrative tasks on the repository.
  • [EXTERNAL_DOWNLOADS]: As part of the wiki mirroring process described in references/hierarchy.md, the skill performs a git clone of the repository's wiki. While targeting the same GitHub environment, this involves downloading external content to a temporary directory for processing.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 20, 2026, 12:30 PM