pr-educational-body
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting external, untrusted data from the repository's history and state to generate a descriptive summary.
- Ingestion points: The workflow explicitly reads data from
git log --oneline main..HEAD,git diff --stat main..HEAD, andgit diff main..HEADas described in SKILL.md. - Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings when processing the output of these git commands.
- Capability inventory: The skill utilizes shell-based tools including
gitfor data ingestion and the GitHub CLI (gh pr create) for outputting the generated content (SKILL.md). - Sanitization: There is no explicit sanitization, escaping, or validation of the content retrieved from the git diffs or logs before it is processed by the agent.
Audit Metadata