pr-creator
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple shell commands including
git,npm run preflight, andgh pr createto manage branches, run local tests, and create PRs. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of repository pull request templates, which could be used as an attack vector to influence the agent's behavior during the drafting process.
- Ingestion points: Pull request templates located at
.github/pull_request_template.mdor within the.github/PULL_REQUEST_TEMPLATE/directory are read and processed in Step 4. - Boundary markers: The instructions lack explicit boundary markers or guidance to ignore potentially malicious instructions embedded within these external templates.
- Capability inventory: The skill has access to sensitive capabilities including
git push(Step 7),npm run preflight(Step 6), and theghCLI (Step 8). - Sanitization: The skill uses a temporary file to pass the PR body to the
ghCLI, which mitigates shell-level command injection but does not sanitize the semantic content of the template itself.
Audit Metadata