create-pull-request
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including local source code, commit history, and GitHub issue descriptions to generate PR titles and summaries.
- Ingestion points: Git diffs, commit messages, and repository-specific issue/specification files.
- Boundary markers: The skill lacks explicit delimiters for untrusted data but enforces a strict output schema for the PR body.
- Capability inventory: Execution of Git commands, GitHub CLI commands, and arbitrary repository-defined verification scripts (tests, builds, linters).
- Sanitization: The instructions explicitly require removing secrets, absolute paths, and internal agent artifacts before publication.
- [COMMAND_EXECUTION]: The skill executes shell commands via the gh and git CLIs. It also runs potentially arbitrary verification commands (e.g., tests, linters) derived from the repository environment.
- The skill mitigates common command injection risks by mandating the use of --body-file and temporary files instead of interpolating multi-line strings directly into shell arguments.
Audit Metadata