document
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from git logs and file diffs which may contain instructions intended to influence the agent's behavior (indirect prompt injection).
- Ingestion points: Commit history and repository diffs are read in the 'Gather the source material' step of
SKILL.md. - Boundary markers: The skill does not use specific delimiters or 'ignore' instructions for the diff content being processed.
- Capability inventory: The skill has permissions to write to the file system (
Write,Edit) and perform actions via the GitHub CLI (gh). - Sanitization: In
agent-prompt.md, there is a mandatory safety rule requiring the agent to detect and redact credentials (tokens, keys) found in the diff, referring to them generically in the output. - [COMMAND_EXECUTION]: The skill executes standard
gitandgh(GitHub CLI) commands to interact with the repository and manage Pull Requests. These commands are used for their intended development purposes and are driven by static logic in the skill instructions. - [DATA_EXFILTRATION]: Repository metadata and generated documentation are transmitted to GitHub when the agent creates or updates a Pull Request. This involves a well-known service and is protected by a requirement for the agent to show the full body and obtain explicit user confirmation before execution.
Audit Metadata