antfu-create-pr
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository, such as git diffs, commit history, and contribution guidelines.\n
- Ingestion points: The agent reads repo content in steps 1, 3, and 7 of the SKILL.md workflow.\n
- Boundary markers: Instructions provided in the skill define how to process this data for PR generation, though no strict technical delimiters are used.\n
- Capability inventory: The agent can execute git, gh, and curl commands.\n
- Sanitization: The skill contains explicit instructions to prevent the agent from including secrets or sensitive data in the PR body.\n- [COMMAND_EXECUTION]: The skill performs standard repository and PR management tasks using git and the GitHub CLI (gh). It also executes a local bash script, scripts/upload-github-attachment.sh, which uses curl and file utilities to manage attachments.\n- [DATA_EXFILTRATION]: The skill uses standard GitHub authentication (GH_TOKEN) to communicate with official GitHub APIs and upload endpoints. All network activity is confined to trusted GitHub domains for the purpose of PR management. The skill includes safety guidelines to avoid accidental disclosure of credentials in PR documentation.
Audit Metadata