file-pr
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub Pull Requests, creating a potential surface for indirect prompt injection.
- Ingestion points: In
SKILL.mdandreferences/existing-pr-reuse.md, the skill usesgh pr viewand the GitHub REST API to fetch Pull Request titles and bodies. - Boundary markers: The instructions do not define clear boundaries or specify that content fetched from GitHub should be treated as untrusted, which could allow instructions embedded in a PR's body to influence the agent's behavior during reconciliation.
- Capability inventory: The skill has significant capabilities documented in
SKILL.md, including code commitment (git commit), repository pushing (git push), and Pull Request creation/modification (gh pr create). - Sanitization: There is no evidence of sanitization or filtering of the external PR data before it is introduced into the agent's operational context.
Audit Metadata