implement-pr
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (tickets, specifications, and repository instructions), which creates a surface for indirect prompt injection where malicious instructions in the data could influence the agent's behavior.
- Ingestion points: The skill reads external tickets and specifications to define the implementation contract as described in Step 2 of
SKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore instructions' warnings when handling external content.
- Capability inventory: The skill triggers shell commands for building, linting, and testing, and performs Git operations via integrated sub-skills like
$file-prand$babysit-pr. - Sanitization: No evidence of validation or sanitization of the ingested external content is present.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute repository-defined build, test, and lint commands. Although expected for a PR automation tool, this involves executing shell commands that carry inherent risk if the repository configuration or the data processed by these tools is malicious.
Audit Metadata