ds-pr
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a proactive security measure in Step 6, which explicitly requires the agent to scan titles, descriptions, and attachments for secrets, tokens, private paths, and personal data, removing them before creating the PR.
- [SAFE]: The skill uses established GitHub CLI tools (
gh pr,gh api) for its primary functions, which is appropriate for its stated purpose of managing pull requests. - [INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface for indirect prompt injection because it reads and mimics the format of external PR titles from the repository history.
- Ingestion points: SKILL.md Step 3 reads titles of recently merged PRs from the repository.
- Boundary markers: No explicit delimiters are defined for the ingested PR titles.
- Capability inventory: The skill possesses write capabilities to the repository via
gh pr createand the GitHub REST API. - Sanitization: The risk is significantly mitigated by the mandatory secret-scanning and redaction step defined in Step 6.
Audit Metadata