issue-to-pr
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from GitHub issues, pull request comments, and project boards to drive its autonomous logic.
- Ingestion points: External data enters the agent context via
triage-evidence.sh(reading issue titles and bodies) andreview-check.sh(ingesting pull request review comments and thread status). - Boundary markers: The instructions do not specify the use of delimiters or boundary markers to isolate external data, increasing the risk that instructions embedded in an issue could be executed by the agent.
- Capability inventory: The agent has access to powerful tools including shell command execution (
run-gates.sh), file system modification (Writetool), and repository management via the GitHub CLI (ghtool for merging and branch management). - Sanitization: There is no explicit mention of sanitizing or filtering external content before it is passed to the research, design, or implementation phases of the pipeline.
Audit Metadata