create-pull-request
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data (such as GitHub issues or repository-specific instructions) which could be used to manipulate the agent's behavior during the pull request creation process.
- Ingestion points: The agent is instructed to read 'repository instructions, the source issue if there is one' in SKILL.md.
- Boundary markers: The skill lacks explicit delimiters or instructions for the agent to ignore or isolate potentially malicious commands embedded within the ingested data.
- Capability inventory: The agent has the ability to perform git operations (
git commit,git push), GitHub CLI actions (gh pr create,gh pr edit), and execute local scripts. - Sanitization: The instructions explicitly require the agent to 'Leave out ... secrets [and] absolute local paths' from the generated PR body (SKILL.md, Section 4).
- [COMMAND_EXECUTION]: The skill facilitates the execution of local repository scripts and commands, which could be malicious if the agent is directed to a compromised repository.
- Evidence: In Section 2 ('Verify') of SKILL.md, the agent is instructed to 'Run the checks the repository requires', which involves executing arbitrary test suites or scripts (e.g.,
npm test,make, or custom scripts) defined within the repository's configuration.
Audit Metadata