continue-pr
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Risk.
- Ingestion points: The skill ingests untrusted data from GitHub Pull Request descriptions and review comments using the
github__pull_request_readtool as described in steps 2 and 5 ofSKILL.md. - Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded commands within the fetched PR content, which may lead the agent to interpret instructions within a PR comment as valid task directives.
- Capability inventory: The agent possesses the capability to execute specific git commands (
fetch,checkout,status,diff,log,push) and interact with GitHub via the allowed tools. - Sanitization: No sanitization or filtering is performed on the external content before it is added to the agent's context.
Audit Metadata