pr
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted instructions and content from repository files and GitHub metadata to influence its output and actions.\n
- Ingestion points: The skill reads
CONTRIBUTING.md,AGENTS.md,CLAUDE.md, and PR templates (pull_request_template.md) from the local file system, and fetches previous PR bodies viagh pr listandgh pr view.\n - Boundary markers: The instructions do not define explicit boundary markers or isolation techniques when interpolating the contents of these external files into the agent's prompt for drafting the PR body.\n
- Capability inventory: The skill possesses the ability to execute
git pushandgh pr create/edit, which are significant capabilities that could be leveraged by a successful injection to push unauthorized code or metadata.\n - Sanitization: The skill performs basic text cleanup (fixing dashes and curly quotes) and uses a 'Claims' matrix for factual verification against diffs, but it lacks specific sanitization to prevent adversarial instructions embedded in repository configuration files.
Audit Metadata