autopilot-pr-triage-worker
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and interpret data from external, untrusted sources such as pull request descriptions, review comments, and linked issue conversations.
- Ingestion points: The skill instructions (SKILL.md) mandate reading the full conversation history of pull requests and any associated issues.
- Boundary markers: The instructions do not explicitly require the use of delimiters to separate untrusted external data from the skill's own instructions during processing.
- Capability inventory: The skill can generate GitHub comments (using the autopilot-comment tool) and apply or remove specific labels based on a predefined schema (assets/label-contract.json).
- Sanitization: The skill does not specify methods for sanitizing the input data gathered from external GitHub sources.
- Contextual Mitigation: The skill's design includes strong guardrails; it is explicitly restricted to advisory recommendations and is not permitted to merge pull requests, request reviewers, or grant human-level approvals (status/accepted).
Audit Metadata