git-pr
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes pull request comments and review bodies from external contributors and bots.
- Ingestion points: Phase 1 of the comment workflow (references/pr-comment-workflow.md) fetches unresolved threads using gh api graphql and REST endpoints.
- Boundary markers: SKILL.md and references/pr-comment-workflow.md mandate a Research Checklist that requires the agent to validate findings against the codebase and conventions.
- Capability inventory: The skill can create, merge, and edit PRs, post comments, and resolve threads.
- Sanitization: The skill relies on the LLM to critically evaluate external content; no programmatic sanitization is applied.
- [COMMAND_EXECUTION]: The skill defines complex Bash functions for the agent to execute PR orchestration tasks.
- Evidence: references/bot-review-loop.md contains functions like bot_status and bot_tick that use gh api and jq for state management.
- [PRIVILEGE_ESCALATION]: The skill suggests auto-approval patterns for Claude Code settings.
- Evidence: references/allowlist.md recommends regex patterns for gh and glab commands, while explicitly documenting the risks of broad wildcards and providing canonical forms to minimize risks.
Audit Metadata