create-pr
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes data from external, potentially untrusted sources.
- Ingestion points: The skill reads output from
git diff --cached --name-only,git diff <base-branch>...HEAD, andgh pr list(SKILL.md). - Boundary markers: There are no explicit instructions to use delimiters or ignore instructions embedded within the git history or PR descriptions.
- Capability inventory: The skill has the ability to execute shell commands (
git,gh), invoke subagents (github-dev:pr-creator,github-dev:commit-creator), and perform web searches via Tavily (SKILL.md). - Sanitization: No sanitization or filtering of the ingested commit messages, code diffs, or PR data is performed before processing.
Audit Metadata