model-pr-diff-dossier
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and analyze external content from GitHub pull requests, which presents a surface for indirect prompt injection.
- Ingestion points:
SKILL.md(Workflow steps 1 and 2) instructs the agent to collect PR links and read diffs directly from GitHub. - Boundary markers: The instructions do not provide delimiters or "ignore embedded instructions" warnings to protect the agent from malicious instructions that could be hidden within a PR description or code diff.
- Capability inventory: The skill utilizes
gh pr difffor data retrieval and mandates the execution of repository tests and formatting tools (SKILL.mdstep 7). - Sanitization: There are no requirements for sanitizing or validating the content retrieved from external PRs.
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands which could lead to unauthorized code execution if the local repository or the PR content being tested is malicious.
- Evidence:
SKILL.md(Workflow step 7) states "Run repository tests and formatting before publishing," which implies the execution of build or test scripts.
Audit Metadata