github-triage
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external content from GitHub issue and pull request bodies/comments, creating a surface for indirect prompt injection.
- Ingestion points: The skill fetches issue and PR metadata, bodies, and comments via
ghCLI commands in Phase 1 and thescripts/gh_fetch.pyscript. - Boundary markers: Data is structured under an
ITEM:key within subagent prompts to separate it from instructions. - Capability inventory: The skill has access to codebase search tools (
grep,read), repository metadata (gh,git), and the ability to spawn background subagents (task,task_create). - Sanitization: No explicit filtering or escaping of the untrusted text is performed; however, the skill's strict read-only policy and requirement for commit-sha-based permalinks significantly limit the impact of any injected instructions.
Audit Metadata