github-workflow-automation
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing untrusted data from GitHub repositories.
- Ingestion points: Untrusted data enters the agent context through PR diffs in
ai-review.yml, issue bodies inissue-triage.yml, and comment text inmention-bot.yml. - Boundary markers: The workflow templates do not include clear delimiters or instructions for the AI to ignore instructions embedded within the interpolated diffs or issue content.
- Capability inventory: The skill's workflows have permissions to write pull request reviews, add labels, create issue comments, and execute git operations including
git push --force-with-lease. - Sanitization: There is no evidence of input validation or content filtering for the data ingested from GitHub.
- [EXTERNAL_DOWNLOADS]: The skill utilizes official GitHub Actions (such as
actions/checkoutandactions/github-script) and the@anthropic-ai/sdklibrary, which are from well-known and reputable sources. - [SAFE]: Sensitive credentials such as the
ANTHROPIC_API_KEYare managed using GitHub Secrets, adhering to industry security standards for CI/CD environments.
Audit Metadata