autopilot-pr-merge-worker
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection: The skill ingests data from pull requests, such as titles, descriptions, and comments, which could serve as a vector for instructions intended to alter the agent's workflow. Ingestion points: Untrusted data enters the agent context through GitHub API calls in assets/worker-prompt.md and assets/copilot-classification-prompt.md. Boundary markers: Explicit instructions in assets/fold-vs-defer-rubric.md and the Step 0.P planning phase help maintain operational boundaries. Capability inventory: The skill can perform file modifications, push to branches, and create PR comments or new PRs via the git and gh CLI tools. Sanitization: The scripts/owner_touch_gate.py script acts as a deterministic gate, verifying all code changes against a predefined ownership table to ensure integrity.
- Command Execution: The skill frequently invokes CLI tools like git, gh, and ruff to manage the PR lifecycle. These calls are managed within the assets/worker-prompt.md and assets/conflict-resolution-prompt.md instructions. The scripts/owner_touch_gate.py script uses the subprocess module to execute git with hardcoded arguments and a resolved executable path, which is a standard method for interacting with system tools.
Audit Metadata