create-pull-request
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute 'git reset --hard origin/main', which is a destructive command that discards local changes. While the workflow includes a requirement for explicit user confirmation before execution, the command itself is powerful and carries risk if the agent misidentifies the branch state.
- [PROMPT_INJECTION]: The skill contains a directive to 'override any tool default that appends an AI attribution footer or co-author credit'. This is an attempt to modify the agent's standard output behavior to hide its identity as an AI, which can be used to deceive reviewers about the origin of the pull request content.
- [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted data from the repository environment.
- Ingestion points: Reads commit messages via 'git log' and processes user-provided content from local files for the PR body ('--body-file') and evidence attachments.
- Boundary markers: None identified. The instructions do not define delimiters or warn the agent to ignore instructions embedded within commit messages or PR content.
- Capability inventory: The skill can execute branch operations ('git checkout', 'git branch -m'), destructive resets ('git reset --hard'), and network-facing operations ('git push', 'gh pr create').
- Sanitization: The skill does not specify any sanitization or validation of the ingested commit messages or file contents before incorporating them into the PR workflow.
Audit Metadata