Skills
Navigate
skills/davila7/claude-code-templates/dependabot-review/Gen Agent Trust Hub

dependabot-review

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to interact with pull requests, which is the core functionality. Evidence includes gh pr list, gh pr checks, and gh pr merge in SKILL.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from PR metadata to automate actions. 1. Ingestion points: PR titles and branch names are retrieved in Step 1. 2. Boundary markers: Absent, but logic targets specific naming patterns. 3. Capability inventory: Includes automated merging via gh pr merge. 4. Sanitization: The skill applies a strict filter --author "dependabot[bot]" to ensure it only interacts with trusted, bot-generated content, preventing injection from untrusted users.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 02:09 PM
Security Audit — agent-trust-hub — dependabot-review