cross-repo-pr-sync
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of shell and Git commands (git clone, git log, git checkout, rm -rf) using parameters derived from configuration files and repository metadata. This introduces a risk of command injection if the underlying agent does not properly sanitize these inputs when constructing shell commands.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external PR content which can contain malicious instructions. Ingestion points: PR titles, bodies, and commit messages from upstream repos. Boundary markers: None. Capability inventory: Branching, committing, and shell execution. Sanitization: None.
- [EXTERNAL_DOWNLOADS]: The skill is designed to clone remote repositories from Git URLs to the local system. While targeting trusted organizations like Ant Design, the ability to clone from arbitrary URLs represents an external data ingestion vector.
- [DYNAMIC_EXECUTION]: The skill provides code templates for Python and Bash and instructs the agent to run them to perform orchestration and API tasks.
Audit Metadata