bug-class-audit
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and analyzes untrusted data from repository pull requests (titles, descriptions, and diffs). An attacker could craft a PR containing instructions designed to manipulate the audit results.
- Ingestion points: Untrusted data enters the agent context via
gh pr viewandgh pr diffcommands inSKILL.md. - Boundary markers: The skill does not explicitly define strict delimiters or instructions to ignore embedded commands within the processed PR content.
- Capability inventory: The skill's capabilities are limited to read operations on repository data using the GitHub CLI; it does not perform write operations or code execution.
- Sanitization: PR content is processed without prior filtering, escaping, or validation.
Audit Metadata