manage-stacked-prs
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official GitHub repository for the 'gh-stack' CLI tool (github.com/github/gh-stack). This is a well-known and trusted source. The instructions explicitly warn the agent not to silently install or upgrade the software, favoring manual user control.
- [COMMAND_EXECUTION]: The skill utilizes several high-privilege Git and GitHub commands, such as 'git rebase --onto' and 'git push --force-with-lease'. These are standard commands for managing stacked PR history and include the recommended safety lease mechanism to prevent overwriting concurrent remote changes by other developers.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from the environment.
- Ingestion points: The agent reads PR bodies, repository-specific instructions, and JSON output from 'gh stack view'.
- Boundary markers: None identified; the skill relies on the agent's ability to distinguish state metadata from instructions.
- Capability inventory: The skill can perform history rewrites (rebase), repository modifications (worktree), and remote writes (push).
- Sanitization: None identified; however, the skill's instructions are highly structured and focused on technical alignment, reducing the likelihood of the agent following arbitrary instructions embedded in PR descriptions.
Audit Metadata