skills/alibaba/neug/create-pr/Gen Agent Trust Hub

create-pr

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the GitHub CLI ('gh') to perform its primary function of submitting pull requests. Specifically, it executes 'gh pr create' with arguments for title, body, and reviewers. This is an expected behavior for a tool designed to manage project contributions.
  • [INDIRECT_PROMPT_INJECTION]: There is a potential attack surface where data from the branch or issue titles could influence the generated PR title or body. However, the skill incorporates a 'User Revision' step (Step 3) where the user must review and approve the content in a temporary file before the final submission command is executed, which serves as an effective mitigation for automated injection attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 10:27 AM
Security Audit — agent-trust-hub — create-pr