worktree-pr-review
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gitandgh(GitHub CLI) to perform repository operations, including creating worktrees, committing changes, pushing to remotes, and creating pull requests. These operations are essential to the skill's documented functionality. - [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection due to the way it handles external data.
- Ingestion points: The agent is instructed to read local files such as repository-specific instructions, code diffs, and project documentation (PRDs, architecture notes, ADRs, design docs) as part of the publishing workflow in
SKILL.md. - Boundary markers: Absent. There are no instructions to use specific delimiters or protective prompting (e.g., "ignore embedded instructions") when the agent processes the contents of these files.
- Capability inventory: The skill possesses the ability to execute shell commands (
git commit,git push,gh pr create) and spawn sub-agents, which could be hijacked if malicious instructions are present in the analyzed files. - Sanitization: Absent. The skill instructions do not require the agent to sanitize or escape data extracted from external documents before including it in pull request titles, bodies, or commit messages.
Audit Metadata