pr-merge-prep
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from PR review comments and CI logs to determine its actions.\n
- Ingestion points: The agent reads PR review comments (Phase 3) and CI failure logs (Phase 2) to identify necessary code changes.\n
- Boundary markers: The instructions do not define any delimiters or negative constraints to prevent the agent from following instructions embedded within these external sources.\n
- Capability inventory: The agent can modify the filesystem (Phase 2 and 3 code fixes), execute shell commands for tests (Phase 2, 3, and 4), and interact with the GitHub API to update PR metadata and descriptions.\n
- Sanitization: There is no mention of sanitizing or validating the contents of the review comments or logs before they are used to generate code or trigger command execution.\n- [DYNAMIC_EXECUTION]: The skill dynamically generates and executes code based on its analysis of external logs and review threads.\n
- Evidence: Phase 2 and 3 require the agent to analyze failures, write "atomic commits" to fix them, and then "run project tests" to verify the results. This cycle of generating code from external input and executing it constitutes a dynamic execution risk.\n- [COMMAND_EXECUTION]: The skill executes discovered shell commands to run tests, which can be influenced by the code modifications the agent makes.\n
- Evidence: The skill attempts to locate test commands in files like
package.jsonorMakefileand execute them in Phases 2, 3, and 4. If an attacker influences the agent to modify these files or the test scripts themselves, the agent will execute the attacker's payload during the verification step.
Audit Metadata