gentle-ai-branch-pr
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard command-line utilities and repository-local scripts to manage development tasks.
- Orchestrates GitHub interactions via the
ghCLI for viewing issues (gh issue view) and creating pull requests (gh pr create). - Runs local verification scripts within the repository:
go run ./internal/gofmtcheckand./docker-test.sh. - Executes standard version control operations using
git. - [INDIRECT_PROMPT_INJECTION]: The workflow involves ingesting data from external sources that could potentially contain malicious instructions.
- Ingestion points: Data enters the context from GitHub issue content via
gh issue viewand user-provided inputs for pull request summaries. - Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within external issue data.
- Capability inventory: The agent is granted capabilities to perform network operations (
gh), file system mutations (git), and local code execution (go,docker). - Sanitization: There are no explicit sanitization steps for data retrieved from issues before it is used to generate pull request content or commit messages.
Audit Metadata