ci-describe-pr
Warn
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill is instructed in Step 6 to parse the 'How to verify it' section of a repository template and execute any identified commands (e.g.,
make check test,npm test). This pattern of automatically running commands extracted from text files enables arbitrary code execution. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection as it processes untrusted data from PR diffs and metadata. Ingestion points:
thoughts/shared/pr_description.md,gh pr viewoutput, andgh pr diffoutput. Boundary markers: Absent; there are no instructions to sanitize or ignore malicious instructions embedded in the ingested data. Capability inventory:ghCLI access (view, list, diff, edit), arbitrary shell command execution, and local file system write access. Sanitization: Absent; the skill is explicitly directed to 'run it' for any command found in the verification section. - [DATA_EXFILTRATION]: Because the skill has access to the GitHub CLI (
gh) and executes shell commands, a malicious command injected into the PR or template could be used to exfiltrate environment variables, authentication tokens, or source code to an external server.
Audit Metadata