pr-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull requests, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: In SKILL.md (Step 3 and Step 4), the agent is instructed to read and analyze PR descriptions, changed components (files/directories), and code diffs provided in the context of the pull request.
- Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between its own instructions and content found within the PR description or code diffs.
- Capability inventory: The skill uses the
harness_listMCP tool to fetch sensitive information about Harness pipelines, triggers, and execution statuses, which could be misused if the agent is successfully injected. - Sanitization: The skill lacks defined sanitization or validation protocols for the external content it processes.
Audit Metadata