cherry-pr-test
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is exposed to indirect prompt injection risks because it processes untrusted inputs from external pull requests.
- Ingestion points: In
SKILL.md, the agent executesgh pr viewandgh pr checkoutto retrieve external pull request details, and is instructed to "Read the changed files and nearby instructions" and "Build test cases from the PR description". - Boundary markers: The instructions lack explicit boundary markers or directives guiding the agent to handle the pull request descriptions and code file contents strictly as untrusted data or to disregard any embedded commands.
- Capability inventory: The execution environment allows running workspace scripts (
pnpm typecheck), managing Electron instances, controlling workflows via Playwright/CDP oragent-browser, and modifying files or directories (e.g.,/tmp/pr-<NUMBER>). - Sanitization: No sanitization, formatting restrictions, or isolation steps are specified for the pull request text or files before they are evaluated by the agent.
Audit Metadata