new-feature
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on several common developer tools to manage the environment. It uses
gitfor creating and removing worktrees, managing branches, and fetching updates. It also uses the GitHub CLI (gh) to list and inspect pull requests, andlsofto check for active network ports. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it instructs the agent to read external data from pull requests.
- Ingestion points: Data enters the context from the output of
gh pr listandgh pr diffcommands executed in the shell. - Boundary markers: There are no specific delimiters or instructions to ignore potential commands embedded in pull request titles, descriptions, or diffs.
- Capability inventory: The agent has the capability to execute shell commands, manage Git branches (including deletion), and install software dependencies within the created worktrees.
- Sanitization: The skill does not define specific sanitization or validation steps for the content retrieved from external pull requests.
Audit Metadata