issue-to-pr

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from GitHub issues, pull request comments, and project boards to drive its autonomous logic.
  • Ingestion points: External data enters the agent context via triage-evidence.sh (reading issue titles and bodies) and review-check.sh (ingesting pull request review comments and thread status).
  • Boundary markers: The instructions do not specify the use of delimiters or boundary markers to isolate external data, increasing the risk that instructions embedded in an issue could be executed by the agent.
  • Capability inventory: The agent has access to powerful tools including shell command execution (run-gates.sh), file system modification (Write tool), and repository management via the GitHub CLI (gh tool for merging and branch management).
  • Sanitization: There is no explicit mention of sanitizing or filtering external content before it is passed to the research, design, or implementation phases of the pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 09:36 PM
Security Audit — agent-trust-hub — issue-to-pr