github-automation
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx claude-flowto execute automation tasks. This command downloads and runs a package from the public NPM registry at runtime. The packageclaude-flowis not identified as a well-known library or a resource belonging to a trusted organization. - [REMOTE_CODE_EXECUTION]: By using
npxwith an unversioned package name, the skill dynamically executes remote code in the host environment whenever GitHub review, issue, or workflow commands are invoked. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading and processing external data from GitHub Pull Requests and Issues, creating a surface for indirect prompt injection where malicious text in a PR could influence agent behavior.
- Ingestion points: GitHub PR data accessed via
claude-flow github reviewand Issue data viaclaude-flow github issues. - Boundary markers: The instructions lack delimiters or safety prompts to prevent the agent from following instructions embedded within the PR or Issue text.
- Capability inventory: The agent has the ability to execute shell commands (
gh) and run third-party scripts (npx). - Sanitization: There are no documented procedures for sanitizing or filtering input from these external sources before the agent processes them.
Audit Metadata