merge-pr
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to merge pull requests identified by conversation context or selection workflows and explicitly directs it to bypass user confirmation for these merges. This reduction in human-in-the-loop oversight presents a surface where a malicious PR could be merged if it is mistakenly selected by an automated process.\n
- Ingestion points: PR URLs, numbers, and repository context derived from conversation history or the results of selection tools.\n
- Boundary markers: Absent. The skill instructions do not include markers or directives to ignore instructions that might be embedded in the metadata of the PRs being processed.\n
- Capability inventory: Modifies external repository state via the
gh pr mergecommand.\n - Sanitization: The helper script
scripts/merge-pr.mjsperforms robust regex validation on all inputs, including PR URLs, numbers, and repository identifiers, preventing direct command injection.\n- [COMMAND_EXECUTION]: The skill executes the GitHub CLI tool (gh) using a Node.js wrapper. Although the script is implemented safely usingspawnSyncwith argument arrays and strict validation, the capability to perform squash-merges and enable auto-merge is a powerful operation that affects external code repositories.
Audit Metadata