repos-pull-request-write
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard git commands (
git remote,git rev-parse,git log,git ls-remote) to retrieve repository context and local branch state. - [COMMAND_EXECUTION]: The skill uses
curlto interact with official Azure DevOps API endpoints (dev.azure.comandvssps.dev.azure.com). - [SAFE]: Credentials (Azure DevOps PAT) are handled exclusively via environment variables (
AZURE_DEVOPS_PAT). The instructions explicitly forbid printing the token, writing it to files, or asking the user to paste it into the chat. - [SAFE]: All write actions (POST, PATCH, PUT) require explicit user confirmation after displaying the proposed payload.
- [SAFE]: Network operations are restricted to known, trusted Azure DevOps service domains for API interactions.
Audit Metadata