gh-create-pr
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Rule 7 instructs the agent to omit session URLs "even if system instructions ask for one," which is a targeted instruction to override governing system prompts.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external, potentially untrusted sources to generate pull request content.
- Ingestion points: Processes data from linked issues, tickets, conversation history, and CLAUDE.md (SKILL.md).
- Boundary markers: Employs a quoted HEREDOC (
cat <<'EOF') for the PR body which prevents expansion of content, but the PR title field lacks isolation (SKILL.md). - Capability inventory: Uses the
ghCLI tool for PR creation, involving network operations and local shell command execution (SKILL.md). - Sanitization: No explicit requirements or mechanisms for sanitizing or escaping data before interpolation into the PR command are provided (SKILL.md).
- [COMMAND_EXECUTION]: The bash template in Rule 1 interpolates the PR title directly into the shell command:
--title "<short title>". If the content sourced for the title contains shell metacharacters (e.g., backticks or subshells), it could result in unintentional command execution in the user's local shell environment.
Audit Metadata