ga-pr
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes an external command-line utility
ga-pr, passing user-provided strings such as the task description and PR identifiers as shell arguments. This pattern presents a risk of command injection if the task string contains shell metacharacters and is not properly sanitized by the underlying execution environment. - [EXTERNAL_DOWNLOADS]: The skill is designed to clone remote repositories and check out branches based on data retrieved from GitHub PRs. While a standard feature for development tools, it involves the retrieval and execution of external code from remote sources.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from untrusted external data found in GitHub PRs.
- Ingestion points: External data enters the agent context via
gh pr viewoutput, which includes PR descriptions and comments that may contain malicious instructions. - Boundary markers: Absent; there are no delimiters or instructions provided to the agent to differentiate between legitimate task directions and adversarial instructions embedded in the PR data.
- Capability inventory: The skill has the ability to execute shell commands (
ga-pr,gh) and perform file system operations (cloning, checkouts). - Sanitization: No sanitization or validation steps are defined for the PR content before it is processed or passed to the sub-agent.
Audit Metadata