draft-pr
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on local shell commands (
git,gh,mktemp) to perform its functions. It uses string interpolation to build command arguments from dynamic content like branch names, PR titles, and bodies, which can be a surface for shell injection if the underlying platform does not sanitize these inputs. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests data from external sources, including existing PR content and repository configuration.
- Ingestion points: PR titles, bodies, and base branch references are retrieved via
gh pr viewandgh repo view. Repository PR templates and Git diffs are also read into the agent context. - Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions to separate retrieved repository content from the agent's core logic.
- Capability inventory: The skill possesses the ability to execute shell commands (
git,gh), write to the local filesystem via redirection (cat > "$tmp_pr_body"), and push modifications to remote repositories. - Sanitization: There is no evidence of sanitization, escaping, or validation of the ingested data before it is interpolated into the agent's prompts or shell commands.
Audit Metadata