ship-it
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from external sources during the PR management process.
- Ingestion points: Reads the PR body for intent (
steps/intent.md), code diffs for review (steps/review.md), and GitHub PR comments/reviews from bots or other users (steps/ci.md). - Boundary markers: Employs structured Markdown sections (e.g.,
## Intent,## Review) and provides verbatim intent/decisions to subagents to maintain context boundaries. - Capability inventory: The agent can execute
gitandghcommands, write files, and spawn subagents for specialized tasks. - Sanitization: The instructions explicitly state that replies and round comments must be plain text only to ensure no downstream bots or systems interpret the content as executable commands.
- [COMMAND_EXECUTION]: The skill utilizes standard development tools, including the Git CLI and GitHub CLI (
gh), to manage local and remote repository states. It also executes a local monitoring script (scripts/watch-pr.sh) to poll the GitHub API for updates. All command execution is aligned with the skill's primary purpose of PR automation.
Audit Metadata