dev-loop-pr-writer
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains Python code (
PRDescriptionGeneratorclass inSKILL.md) and a shell script (scripts/generate-pr-body.sh) that utilizesubprocess.runand direct shell execution to rungitcommands (git diff,git log,git stat). While standard for development tools, these represent a capability to execute shell commands within the environment. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes external, untrusted data including git commit messages, git diff outputs, and issue tracker references to generate PR summaries.
- Ingestion points: Commit messages and issue descriptions enter the agent context through the workflow context and generation scripts.
- Capability inventory: The skill possesses shell execution capabilities through the use of
subprocess.runand shell scripts. - Boundary markers: The skill lacks explicit delimiters or instructions to prevent the agent from obeying malicious commands embedded within the processed git metadata.
- Sanitization: No validation or escaping logic is provided to sanitize input data (e.g., commit messages) before it is interpolated into PR descriptions or prompts.
- [DATA_EXPOSURE]: The provided scripts access the repository's internal git history and diff stats. While functional, this exposes sensitive metadata regarding the project's development history to the agent.
Audit Metadata