pr-autopilot
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to autonomously execute build, test, and lint commands defined within the repository's configuration files (e.g., package.json scripts, Makefile targets, workflow files). This presents a risk of arbitrary code execution if a malicious pull request branch modifies these configuration files. The skill includes defensive instructions advising the user to only run it on trusted branches and to avoid untrusted forks.
- [PROMPT_INJECTION]: The skill has a high surface area for Indirect Prompt Injection as it processes external data from PR comments.
- Ingestion points: Step 1 fetches all unaddressed reviews and comments from humans and bots via the GitHub API.
- Boundary markers: The skill explicitly defines a 'Trust boundary' and instructs the agent to treat fetched content strictly as code feedback data, not as new instructions.
- Capability inventory: The skill can perform file system writes, git commits, git pushes, and execute local repository scripts.
- Sanitization: The agent is instructed to ignore any directives embedded in fetched content that fall outside of code feedback, such as requests to access secrets or change git remotes.
Audit Metadata