pr
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses git and gh CLI tools for repository management, including branch detection, diffing, logging, and pull request operations. These commands are triggered by natural language intents and are limited to the skill's stated scope.\n- [DATA_EXPOSURE]: The skill implements secret management best practices by explicitly instructing the agent to never stage .env files, credentials, or large binaries during the auto-commit process.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from git logs and existing PR descriptions to generate metadata. This potential attack surface is documented through the following evidence chain:\n
- Ingestion points: Untrusted data enters the agent context through
git diff,git log,gh pr list(existing PR bodies), and repository-specific templates.\n - Boundary markers: Explicit delimiter-based boundary markers are absent from the prompt instructions.\n
- Capability inventory: The skill possesses capabilities to modify repository state and PR metadata using
git commit,git push,gh pr edit,gh pr merge, andgh pr close.\n - Sanitization: The risk is mitigated by a mandatory human-in-the-loop confirmation step (Step 2) and sanitization rules that strip GenAI-specific metadata from the generated output.
Audit Metadata