github-agile
Pass
Audited by Gen Agent Trust Hub on Feb 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts
gh-audit.ts,gh-init-project.ts,gh-sync-context.ts, andgh-verify.tsutilize Deno'sDeno.CommandAPI to execute system binaries forgh(GitHub CLI) andgit. These operations are essential for the skill's documented purpose of managing GitHub resources and repository state. - [EXTERNAL_DOWNLOADS]: The documentation in
SKILL.mdprovides guidance for installing the official GitHub CLI tool via standard platform package managers such as Homebrew (macOS), apt (Linux), and winget (Windows). - [PROMPT_INJECTION]: The
gh-sync-context.tsscript fetches content from GitHub issues and pull requests to update local documentation files. This represents an indirect prompt injection surface; however, the skill incorporates mitigations such as markdown code blocks to encapsulate external data and character truncation for previews, reducing the risk of the agent misinterpreting ingested data as instructions.
Audit Metadata