bulk-github-star
Warn
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Node.js snippet uses child_process.execSync with unsanitized variable interpolation of the username, creating a command injection vulnerability where a malicious input could execute arbitrary shell commands.
- [COMMAND_EXECUTION]: The documentation advises users to run sudo apt-get for installation, which grants root-level permissions to the package manager and potential installation scripts.
- [COMMAND_EXECUTION]: Bash script examples utilize unquoted variables for usernames and repository names, which can lead to shell injection or unexpected execution if the inputs contain special characters.
- [PROMPT_INJECTION]: Ingestion points: Username from user input and repository metadata retrieved from GitHub API. Boundary markers: None. Capability inventory: Executes shell commands via GitHub CLI and child_process.execSync. Sanitization: No input validation or escaping is implemented for user-provided or external strings before shell execution.
Audit Metadata