autofix
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external PR comments and repository-specific instruction files which serve as potential vectors for malicious instructions.\n
- Ingestion points: Data is ingested from local AGENTS.md files (Step 0) and via GitHub API calls for PR review threads (Step 3).\n
- Boundary markers: The skill does not use specific delimiters for external content but relies on explicit negative constraints and safety notes in its instructions to the agent.\n
- Capability inventory: The agent has permissions to edit repository files and execute version control commands via git and the GitHub CLI.\n
- Sanitization: The skill provides a comprehensive set of sanitization rules in Step 6 to redact sensitive information and ignore command execution prompts from reviewers.\n- [COMMAND_EXECUTION]: The skill performs shell operations using git and the GitHub CLI (gh) to manage the local and remote repository state.\n
- Evidence: The workflow includes multiple shell command blocks for managing PRs and repository state, such as gh pr list, gh api graphql, and git commit.
Audit Metadata