create-pr
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources that can be controlled by third parties, creating a surface for indirect prompt injection attacks.
- Ingestion points: The agent is instructed to read PR comments, review feedback (via
gh api), and CI/check logs (viagh run view --log-failed) in Phase 3. - Boundary markers: There are no explicit delimiters or instructions to treat external data as untrusted or to ignore instructions embedded within those data sources.
- Capability inventory: The skill possesses significant capabilities, including modifying the local filesystem, executing
git commit,git push,git merge, and performing PR operations viagh pr createandgh pr merge. - Sanitization: The skill lacks technical sanitization for the content fetched from GitHub APIs, relying solely on the LLM's judgment to "skip comments that require design decisions."
Audit Metadata