open-pr
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
gitto retrieve branch history and diffs, andgh pr createto submit pull requests. These commands are necessary for the skill's intended purpose of managing PR workflows. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing external data from commit messages and code diffs to synthesize PR descriptions. Malicious instructions embedded in these sources could potentially influence the agent's output.
- Ingestion points: Commit history and repository diffs (SKILL.md).
- Boundary markers: Absent. There are no delimiters or instructions to ignore commands within the analyzed code content.
- Capability inventory: Shell command execution via
ghandgit(SKILL.md). - Sanitization: None. The skill does not implement filtering or escaping of the ingested code content before processing.
Audit Metadata