github-release-pr-writer
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from repository sources, creating a surface for indirect prompt injection.
- Ingestion points: Reads repository documentation, PR templates, manifest files, PR metadata via
gh pr view, and commit history viagit log. - Boundary markers: The skill lacks explicit markers or delimiters to isolate ingested data from system instructions.
- Capability inventory: The skill can execute
gitcommands and update GitHub pull requests usinggh pr edit. - Sanitization: Step 7 includes a sanitization process, but it focuses on preventing credential and path leakage rather than neutralizing malicious instructions embedded in processed data.
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) andgitto interact with repositories. These tools are used to view PR data, perform diffs, fetch tags, and update pull request descriptions. The skill explicitly requires user authorization before executing write commands likegh pr edit. - [SAFE]: The skill implements several best practices, including a dedicated sanitization step to remove tokens, usernames, and local paths from its output. It also defaults to local drafts, avoiding automated external modifications without user intervention.
Audit Metadata