pull-request-automation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's workflow templates utilize official GitHub Actions from the 'actions' organization and Codecov for continuous integration, which are well-known and trusted sources.
- [COMMAND_EXECUTION]: Provides shell scripts for commit message validation ('references/bors-merge-automation-configuration.md') and test scaffolding ('scripts/scaffold-tests.sh'). These scripts facilitate repository maintenance and follow standard automation patterns.
- [INDIRECT_PROMPT_INJECTION]: The automation workflows ingest untrusted data from pull request titles and review states, which could potentially be crafted to influence automated repository actions.
- Ingestion points: Pull request titles and review states are processed in 'references/github-actions-auto-merge-on-approval.md' and 'references/github-actions-auto-review-assignment.md'.
- Boundary markers: The workflows do not use delimiters or explicit instructions to separate external metadata from the workflow logic.
- Capability inventory: The workflows are configured to merge pull requests, request reviews, and apply labels via 'actions/github-script'.
- Sanitization: Basic validation for PR titles using regular expressions is provided in 'references/pr-title-validation-workflow.md'.
Audit Metadata