blast-radius
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to create and run scripts or tests that execute the project's actual code to verify safety assumptions (Step 5). This is a core part of the skill's intended functionality for technical analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from version control systems, which represents a potential attack surface.
- Ingestion points: The skill reads pull request content and commit history using
gh pr viewandgit log(SKILL.md). - Boundary markers: No specific markers or delimiters are instructed for the external data.
- Capability inventory: The skill uses
ghandgittools and has the capability to write and execute scripts locally. - Sanitization: No explicit sanitization of the PR data or commit messages is described prior to analysis or script generation.
- [COMMAND_EXECUTION]: The skill uses command-line tools such as
gh(GitHub CLI) andgitto perform its primary tasks of retrieving code and metadata for review.
Audit Metadata