pull-requests
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill provides documented examples of using the
gh(GitHub) CLI to create pull requests and manage review comments. These commands are standard for the intended workflow and use the official GitHub CLI to interact with the repository. - Indirect Prompt Injection Surface: The skill processes external review comments from GitHub which could theoretically contain instructions. However, the skill implements a protective human-in-the-loop mechanism by requiring the user to review and approve an implementation plan before any code changes are made. This effectively mitigates the risk of an agent blindly following instructions embedded in PR comments.
- Integration with Internal Tooling: The skill references internal repository files and other skills (like
community-projects) to ensure consistency. These references use local paths and are part of the repository's integrated guidance system.
Audit Metadata