pr-autopilot
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted pull request comments to drive autonomous code changes. Ingestion points: Reviews and comments fetched from bots and humans in SKILL.md (Step 1). Boundary markers: Absent; the instructions do not require the use of delimiters or 'ignore instructions' warnings to isolate untrusted data. Capability inventory: The skill performs
git commit,git push, and GitHub API interactions in SKILL.md (Step 3 and 4). Sanitization: Absent; there is no explicit filtering or validation of the content within the comments before the agent identifies them as actionable. - [COMMAND_EXECUTION]: The skill executes Git operations (
git checkout,git commit,git push) and GitHub API requests autonomously without user intervention or a manual plan-approval gate. While branch safety guardrails are present (e.g., no force-push, head-branch only), the autonomous nature of the loop increases the potential impact of misdirected actions.
Audit Metadata