pr
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external and local sources to generate PR content and decide on workflow steps.
- Ingestion points: Reads content from
.github/pull_request_template.md,gh issue list(external data), andgit diff/git log(project data). - Boundary markers: The skill does not define explicit delimiters or instructions to the agent to disregard instructions potentially embedded within the PR template or commit history.
- Capability inventory: The agent can execute git commands (
git push,git branch -m), GitHub CLI commands (gh pr create), and project-defined verification scripts (tests/linters). - Sanitization: No explicit sanitization or validation of the ingested strings is performed before they are used to generate the PR title and body or before executing local verification scripts.
Audit Metadata