create-pr-with-evidence
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing shell commands through
gitandgh(GitHub CLI) to manage branches, compute diffs, capture screenshots, and publish pull requests. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and prioritize repository-specific instruction files such as
AGENTS.md,CLAUDE.md, andCONTRIBUTING.md. This creates a potential surface for indirect prompt injection if the repository being processed contains malicious instructions designed to hijack the agent's behavior. - Ingestion points: Local repository files including
AGENTS.md,CLAUDE.md, and the PR template. - Boundary markers: None specified for the content of repository-level instructions.
- Capability inventory: The agent has capabilities to read files, write to the file system (temporary worktrees), execute shell commands (git, gh, and repository-defined checks), and upload assets to GitHub.
- Sanitization: The skill does not specify sanitization for the content loaded from these configuration files.
- [DATA_EXPOSURE]: The skill includes defensive instructions specifically directing the agent not to include secrets, tokens, or private user data in the pull request body.
Audit Metadata