create-human-reviewed-pr
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources which could contain malicious instructions aimed at the agent.\n
- Ingestion points: The skill collects "issue context" and "existing PR" content from the GitHub repository as documented in SKILL.md.\n
- Boundary markers: The instructions do not specify the use of clear delimiters or "ignore embedded instructions" warnings when interpolating the collected context into the new PR body.\n
- Capability inventory: The skill uses the
ghCLI and delegates publication to the$create-prskill, which has the capability to write to the repository.\n - Sanitization: No explicit sanitization or filtering of the ingested context is described in the instructions.\n- [COMMAND_EXECUTION]: The skill executes shell commands to interact with the GitHub API to resolve user information.\n
- Evidence: The instruction
gh api --hostname <github-host> user --jq .loginis used to resolve the reviewer's username in SKILL.md.
Audit Metadata