shipping-pr
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an automated feedback loop that ingests data from external sources, creating an indirect prompt injection surface.
- Ingestion points: The orchestrator fetches PR state, CI check results, and commit statuses via the
ghCLI and GitHub API (SKILL.md,reference/polling.md). It also triggers sub-agents to process review comments from automated services like CodeRabbit. - Boundary markers: The provided scripts do not include explicit boundary markers or delimiters when passing external content to the LLM or sub-agents to prevent the interpretation of embedded instructions.
- Capability inventory: The skill dispatches the
resolving-pr-blockersagent, which possesses capabilities to modify the filesystem and perform repository write operations (reference/blocker-resolution.md). - Sanitization: There is no evidence of sanitization or validation logic to filter out potentially malicious instructions embedded in external data (e.g., CI logs or review comments) before they are processed by the AI context.
Audit Metadata