create-pull-request

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts (analyze_changes.py, quality_checks.py) to execute local git and gh commands. These operations are necessary for analyzing the repository state, checking for merge conflicts, and creating/editing pull requests as described in the skill's purpose. The commands are executed locally and are restricted to the context of the active project repository.
  • [DATA_EXFILTRATION]: No unauthorized data exfiltration patterns were detected. The skill interacts with the repository's configured origin via standard git/gh commands to push branches and manage pull requests. It does not make arbitrary network requests or send data to external third-party services.
  • [PROMPT_INJECTION]: The skill processes data from the repository, such as commit messages and file names, to generate pull request summaries. While this represents a surface for indirect prompt injection, the skill includes guardrails such as human-in-the-loop approval before any final action is taken, and the usage is consistent with standard developer automation tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 12:04 PM
Security Audit — agent-trust-hub — create-pull-request