ship-ready-pr-loop
Warn
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs third-party tools from
addyosmani/agent-skillsandmattpocock/skillsusingnpx. These sources are personal GitHub accounts rather than official organization repositories. - [COMMAND_EXECUTION]: The workflow identifies and executes project-specific validation commands (e.g., tests, linting) by inspecting local configuration files such as
package.jsonorMakefile. This represents a risk if the repository contains malicious configuration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR comments to determine progress. While it filters for specific users, the reliance on external content to drive automation steps presents an attack surface. Mandatory Evidence: 1. Ingestion: GitHub PR comments and repository documentation. 2. Boundaries: Absent. 3. Capabilities: Extensive shell execution (git, gh, npm, npx). 4. Sanitization: Minimal (jq filtering).
- [DYNAMIC_EXECUTION]: The instructions direct the agent to read and follow executable instructions from
SKILL.mdfiles stored in the local filesystem if they are not already integrated into the harness.
Audit Metadata