ha-merge-queue
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the public
home-assistant/corerepository, including pull request descriptions, review threads, and code diffs, which could contain adversarial instructions.\n - Ingestion points: The agent is instructed to read pull request bodies, review submissions, and review threads to verify merge criteria as defined in the 'Verify each finalist' section of SKILL.md.\n
- Boundary markers: No explicit delimiters (e.g., XML tags or specific 'ignore' instructions) are used to separate the ingested pull request content from the agent's primary instructions.\n
- Capability inventory: The skill allows for searching and reading repository data but strictly prohibits any automated write actions, merges, or comments on GitHub, as mandated in the 'IMPORTANT' section. This significantly limits the risk of an injection influencing unauthorized state changes.\n
- Sanitization: There are no requirements or instructions for sanitizing or filtering the external text before the agent processes and interprets it.
Audit Metadata