open-pr
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gitandghCLI commands to perform its primary function. This includes commands likegit remote -v,git rev-parse,git log, andgh pr create. - [DATA_EXFILTRATION]: The skill reads repository information (remotes, branch names, commit logs, and diff stats) and transmits this information to GitHub via the
ghcommand. This behavior is consistent with the skill's documented purpose of creating pull requests. - [SAFE]: The skill demonstrates defensive coding practices by specifically instructing the agent to use heredocs (
<<'EOF') and stdin (--body-file -) when creating the PR body. This technique prevents potential shell injection or history expansion issues (such as with the!character) that could occur if user-controlled content were passed as direct command-line arguments.
Audit Metadata