github-pr-creation
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection syntax in SKILL.md to execute shell commands when the skill is loaded to provide context about the current git state. Evidence: Execution of git rev-parse and git log at load time.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with the environment and GitHub API. Evidence: Usage of gh issue list, project tests, gh label list, gh api, and gh pr create.
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from various local and remote sources which could contain malicious instructions designed to influence the agent's PR generation. 1. Ingestion points: Local files such as .s2s/plans/.md, .kiro/specs//tasks.md, .cursor/rules/*.md, tasks.md, and GitHub issue descriptions. 2. Boundary markers: None are defined for the ingested data to prevent the agent from following instructions inside them. 3. Capability inventory: The skill can execute shell commands (tests) and perform write operations to GitHub via the CLI. 4. Sanitization: There is no evidence of sanitization or escaping for the data extracted from task files or issues before it is used in PR creation.
Audit Metadata