github-create-pr
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local git commits and diffs to generate PR descriptions, creating a potential surface for indirect prompt injection.
- Ingestion points: The agent executes
git logandgit diffcommands inSKILL.mdto ingest change summaries and diff content. - Boundary markers: The instructions lack explicit data delimiters (like XML tags or unique markers) for the ingested git output, relying instead on task-based workflow stages.
- Capability inventory: The skill utilizes the
gitCLI for repository inspection and theghCLI for pull request creation and modification. - Sanitization: The skill contains a mandatory sanitization phase (Step 5 in
SKILL.md) that explicitly instructs the agent to remove absolute paths, machine-specific environment details, and credentials from the PR content before publication.
Audit Metadata