gh-address-comments
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to use the gh CLI with elevated permissions, specifically requesting 'workflow' and 'repo' scopes to manage GitHub resources and Action workflows.
- [PROMPT_INJECTION]: The skill processes untrusted external data from GitHub PR comments, creating an indirect prompt injection risk where instructions embedded in comments could influence agent behavior. (1) Ingestion points: PR comments fetched via scripts/fetch_comments.py. (2) Boundary markers: None; the instructions do not include delimiters or warnings to ignore embedded instructions. (3) Capability inventory: The agent is authorized to run gh CLI commands and modify files in the repository. (4) Sanitization: No sanitization or validation of the fetched comment content is specified.
- [NO_CODE]: The core logic for the skill, scripts/fetch_comments.py, is referenced in the instructions but not included in the provided files, preventing a security audit of the script's actual behavior.
Audit Metadata