pr-merge-sequence
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process potentially untrusted content from GitHub, including pull request comments, reviews, and inline threads (SKILL.md, sections 'Before changing branches' and 'Rebase and merge loop'). This data is processed as natural language instructions for the agent to 'resolve findings' or 'reply'.
- Ingestion points: Pull request metadata, base/head branches, check results, review findings, and inline discussion threads in SKILL.md.
- Boundary markers: Absent. There are no instructions to the agent to treat content from PR comments strictly as data or to ignore embedded commands, which could allow a contributor to influence the agent's actions through a malicious comment.
- Capability inventory: The skill utilizes
gitfor branch manipulation (rebase,push --force-with-lease) and the GitHub CLI (gh pr merge) for merging. - Sanitization: Absent. The instructions do not specify any validation or filtering of the text retrieved from external PR comments or reviews.
Audit Metadata