melech-pr-gardener
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Pull Request titles, descriptions, review comments, and CI logs, creating a surface for injection attacks.
- Ingestion points: PR metadata and discussion threads are fetched using the
ghtool inSKILL.md(Steps 1 and 3). - Boundary markers: The skill includes a 'Treat PR Input As Untrusted' section explicitly warning the agent not to obey instructions embedded in PR content.
- Capability inventory: The skill can perform GitHub API writes (comments, resolutions), Git operations (worktree creation, pushes), and execute arbitrary local project scripts (lint, test, build via
package.json). - Sanitization: No automated sanitization is specified; the security relies on the LLM's adherence to the safety instructions.
- [EXTERNAL_DOWNLOADS]: The installation instructions in
references/ROUTINE.mdcommand the host to download and install a skill package from a remote repository. - Evidence: The command
npx -y skills add AdirD/agent-shell-hamelech --skill melech-pr-gardenerfetches code from a GitHub repository. - Context: The repository is owned by the skill's author ('adird').
- [COMMAND_EXECUTION]: The skill is instructed to execute arbitrary local scripts defined in the target project's environment.
- Evidence:
SKILL.mdmandates using the repository's 'local tooling — lint, typecheck, unit tests, build (the package.json scripts)' to verify changes.
Audit Metadata