create-pr
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests and processes untrusted data from the local environment to generate pull request content.
- Ingestion points: The skill reads project context from
.chalk/chalk.jsonand retrieves content from the repository's commit history (git log) and file differences (git diff). - Boundary markers: The instructions lack explicit boundary markers or directives to the agent to disregard instructions potentially embedded within the configuration files or commit messages.
- Capability inventory: The skill utilizes the
Bashtool to executegitandgh(GitHub CLI) commands based on the processed data. - Sanitization: There is no evidence of sanitization or validation of the data retrieved from the repository before it is interpolated into the PR body template, which could allow an attacker with write access to the repository to influence the agent's output.
Audit Metadata