GitHub GH-600: Implement tool use and environment interaction Practice Questions

Restricting the tool to a command allow list (Option D) prevents the agent from executing arbitrary or malicious commands, directly limiting the blast radius of any prompt injection or misconfiguration. Using an ephemeral, isolated runner (Option E) ensures that even if a dangerous command executes, it cannot access production secrets or persist state maliciously. Option B is incorrect because storing a command list in a secret doesn't enforce the allow list—it must be enforced in the tool's execution logic, not merely stored as a secret. Option A is incorrect because Dependabot scans dependencies for known CVEs; it does not mitigate the runtime risk of arbitrary shell command execution by an agent. Option C is incorrect because requiring human review of every shell output converts the agent to a human-in-the-loop system, which defeats the purpose of autonomous execution and is not a scalable mitigation.

Creating and pushing a branch requires contents: write (to write to the repository's git content), and opening a pull request requires pull-requests: write. These two permissions are the minimum necessary for the described autonomous actions. Option C is incorrect because actions: write controls workflow management (enabling/disabling, creating workflow dispatch events), not branch or PR creation. Option A is incorrect because issues: write is needed to comment on or create issues, not to open a pull request; PR-issue linking is a UI feature, not a permission requirement. Option F is incorrect because packages: write is for GitHub Packages and is unrelated to branch or PR operations. Option D is incorrect because checks: write enables posting check runs, which is a separate concern from creating a branch or PR.

Rolling back a PR requires three things: (D) permission to close or revert the PR (the agent needs PR write permissions); (B) a configured trigger that maps a check failure signal to the rollback action (without this logic the agent cannot decide when to roll back); and (A) write access to the branch to push a reverting commit or delete the branch. Option C is incorrect because while log access is useful for diagnostics, the rollback trigger is driven by check status events, not raw log parsing. Option F is incorrect because SHAs for rollback can be retrieved dynamically from the GitHub API; storing them in secrets is unnecessary and a security anti-pattern. Option E is incorrect because GitHub Advanced Security is a code scanning and secret scanning product; it is not required for rollback logic based on CI check failures.

Emitting structured tool invocation logs to a persistent store (Option A) provides a detailed, queryable record of every agent action, fulfilling auditability at the tool level. Enabling GitHub audit log streaming (Option C) captures agent-triggered platform events in the organization's audit trail, supporting accountability at the GitHub API level. Together these cover both fine-grained tool use and platform-level events. Option E is incorrect because storing the system prompt in a secret makes it less accessible to auditors, not more, and the system prompt is not a record of actions taken. Option D is incorrect because limiting token output degrades agent effectiveness and does not produce an audit trail. Option B, while a useful transparency practice for PRs, is not a comprehensive audit mechanism—it only covers PR-related actions and is not a reliable, tamper-resistant log.

When an MCP server is added as a tool source, its tools are not automatically available to the agent—they must also be explicitly permitted via the MCP allow list. This allow list governs which MCP-exposed tools the agent may call at runtime. Option D is incorrect because CODEOWNERS controls code review assignments, not tool discovery. Option A is incorrect because MCP tool definitions are not imported via workflow steps; the allow list is the correct mechanism. Option B is incorrect because MCP tools are not configured through repository secrets; secrets store credentials, not tool permissions.