create-pr

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests and processes untrusted data from the local environment to generate pull request content.
  • Ingestion points: The skill reads project context from .chalk/chalk.json and retrieves content from the repository's commit history (git log) and file differences (git diff).
  • Boundary markers: The instructions lack explicit boundary markers or directives to the agent to disregard instructions potentially embedded within the configuration files or commit messages.
  • Capability inventory: The skill utilizes the Bash tool to execute git and gh (GitHub CLI) commands based on the processed data.
  • Sanitization: There is no evidence of sanitization or validation of the data retrieved from the repository before it is interpolated into the PR body template, which could allow an attacker with write access to the repository to influence the agent's output.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 08:40 AM
Security Audit — agent-trust-hub — create-pr