ai-create-pr
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git diff and git log output to generate PR descriptions. This content could contain malicious instructions designed to manipulate the agent's behavior during summary generation.
- Ingestion points: Reads branch diffs and logs using git commands (SKILL.md).
- Boundary markers: None specified to distinguish between the diff content and the agent's instructions.
- Capability inventory: The agent has access to Read, Write, and Edit tools for the local filesystem, and can execute bash commands.
- Sanitization: There is no explicit sanitization or filtering of the diff content before it is processed by the model.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several bash and git commands (git rev-parse, git log, git diff, date, basename) to extract metadata and project information. While these are used for legitimate automation, they represent the skill's operational capabilities on the local system.
Audit Metadata