rebasing-dependabot-prs
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the official GitHub CLI (
gh) for all operations, including authentication checks, listing PRs, and posting comments. These are standard developer operations and do not pose a risk of unauthorized command execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of pull request titles and commit author information from the GitHub repository.
- Ingestion points: PR metadata is fetched using
gh pr listandgh pr viewinSKILL.md. - Boundary markers: Data is presented to the user in a tabular format for manual review before any action is taken.
- Capability inventory: The skill has the capability to post public comments to pull requests via
gh pr comment. - Sanitization: The skill includes robust input validation: PR numbers provided by users are restricted to digits only, the author is strictly verified as
app/dependabot, and the final action uses a hardcoded string (@dependabot rebase) rather than external data, preventing injected content from influencing the automated response. - [SAFE]: The skill requires a mandatory human-in-the-loop confirmation step (Step 4) before executing any write operations, ensuring the user has full control over the actions performed.
Audit Metadata