sdk-adoption-tracker
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's internal Python logic and the standalone script (scripts/fetch.py) explicitly disable SSL certificate verification when communicating with the GitHub API. This is accomplished via the use of
ssl._create_unverified_context()throughout the implementation. This bypasses critical security checks, allowing for potential interception or modification of traffic between the agent and GitHub servers. - [INDIRECT_PROMPT_INJECTION]: The skill has a significant vulnerability surface for indirect prompt injection due to its core functionality of fetching and presenting external data.
- Ingestion points: The skill fetches repository names, descriptions, file paths, and user/organization metadata (bios, company names) from the GitHub Code and Repositories APIs in SKILL.md (Steps 3 and 5) and scripts/fetch.py.
- Boundary markers: The skill lacks delimiters or explicit instructions to the agent to ignore embedded commands within the fetched data before it is presented in Step 6.
- Capability inventory: The skill environment permits shell command execution (bash) and file system write operations (docs/sdk-adopters/).
- Sanitization: No sanitization, escaping, or filtering is applied to the metadata fetched from GitHub before it is processed by the agent to generate outreach briefs.
- [COMMAND_EXECUTION]: The skill frequently executes complex Python scripts using shell redirection and heredocs (
PYEOF). This execution model makes it difficult to audit the integrity of the code being run at each step and increases the risk of command injection if parameters were to be unsafely handled in future updates.
Audit Metadata