pr-autopilot

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted pull request comments to drive autonomous code changes. Ingestion points: Reviews and comments fetched from bots and humans in SKILL.md (Step 1). Boundary markers: Absent; the instructions do not require the use of delimiters or 'ignore instructions' warnings to isolate untrusted data. Capability inventory: The skill performs git commit, git push, and GitHub API interactions in SKILL.md (Step 3 and 4). Sanitization: Absent; there is no explicit filtering or validation of the content within the comments before the agent identifies them as actionable.
  • [COMMAND_EXECUTION]: The skill executes Git operations (git checkout, git commit, git push) and GitHub API requests autonomously without user intervention or a manual plan-approval gate. While branch safety guardrails are present (e.g., no force-push, head-branch only), the autonomous nature of the loop increases the potential impact of misdirected actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 04:39 AM
Security Audit — agent-trust-hub — pr-autopilot