issue-import-from-pr
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Processing of External PR Content: The skill ingests data from public Pull Requests, including titles, bodies, and comments, which could potentially contain malicious instructions (indirect prompt injection). The skill addresses this by explicitly instructing the agent to treat this content as data rather than directives and employs markdown fencing to delineate external text.
- GitHub API and CLI Interactions: The skill utilizes the
ghCLI and GitHub's GraphQL API to perform operations such as viewing PRs, searching issues, and updating project boards. These operations are scoped to the project's tracker and upstream repositories and are used to automate the triage workflow. - Sanitization of Command Inputs: To prevent command injection from attacker-controlled PR titles, the skill uses a secure pattern of writing the title to a temporary file and passing it to the GitHub API via the
-Fflag. This ensures that shell metacharacters in the title are not executed. - Local Framework Verification: The skill executes a local Python module (
setup_preflight) to verify that the environment and configuration are correctly set up. This is a standard self-check for this framework to ensure consistent behavior across different installations.
Audit Metadata