pr-creator
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection vulnerability through external data ingestion.
- Ingestion points: The skill fetches issue descriptions and PR comments from GitHub using the
scripts/gh_pr.py issueandscripts/gh_pr.py commentscommands. - Boundary markers: The instructions in
SKILL.mddo not specify delimiters or provide warnings to the agent about ignoring potential instructions embedded within the fetched GitHub content. - Capability inventory: The agent is authorized to execute shell commands (e.g., git operations, uv run), modify the local filesystem to implement code changes, and interact with the GitHub API (replying to comments, merging PRs).
- Sanitization: The Python script
scripts/gh_pr.pyacts as a direct wrapper for the GitHub API and does not perform any sanitization or filtering on the retrieved text bodies.
Audit Metadata