stack
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The workflow involves the agent reading and writing data to GitHub Pull Request bodies, which constitutes an ingestion surface for untrusted data.
- Ingestion points: Pull request bodies and stack metadata in the .git/stack directory.
- Boundary markers: The tool uses 'stack:links' comment blocks to delimit data in PR bodies.
- Capability inventory: The skill allows the agent to execute 'git push --force-with-lease', perform rebases, and modify PR targets on GitHub.
- Sanitization: The documentation does not specify how external content is sanitized before being displayed to the agent.
Audit Metadata