pr-open
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it incorporates external data into its workflow.
- Ingestion points: Untrusted data is ingested from Jira tickets via MCP servers and from local branch changes (SKILL.md).
- Boundary markers: Absent. The instructions do not use specific delimiters or warnings to isolate the external Jira content from the system prompt.
- Capability inventory: The skill has the capability to perform write operations on GitHub by opening new Pull Requests.
- Sanitization: Absent. There is no requirement to sanitize or validate content from Jira before it is processed by the agent.
Audit Metadata