pr-creation
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to ingest and analyze pull request content, which is externally provided and potentially untrusted. This creates a vulnerability surface for indirect prompt injection where malicious instructions embedded in a PR could attempt to subvert the review sub-agents.
- Ingestion points: Pull request code, titles, and descriptions fetched from GitHub repositories using git and gh CLI tools.
- Boundary markers: The skill lacks instructions to wrap untrusted PR content in delimiters or to provide explicit 'ignore embedded instructions' warnings to the review sub-agents.
- Capability inventory: The agent uses CLI tools (gh, git) to fetch data and invokes multiple parallel review agents (code-first, testing, skeptical, big-picture) and external models (Codex) to process the data.
- Sanitization: The process does not mention sanitizing, escaping, or validating pull request content before it is processed by other agents.
Audit Metadata