create-pr
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes session changes which may contain untrusted data to generate PR metadata. 1. Ingestion points: The skill reviews all changes in the current session (Step 3). 2. Boundary markers: The instructions lack specific delimiters or warnings to ignore instructions that might be embedded within the session changes. 3. Capability inventory: The skill utilizes the GitHub MCP server to perform network operations, specifically creating a pull request. 4. Sanitization: There is no explicit process mentioned for sanitizing or validating the session data before it is processed.
- Automated Execution without User Confirmation: The skill explicitly instructs the agent to bypass the confirmation UI. Evidence: Step 6 specifies 'show_ui=false'. Context: Bypassing the confirmation step reduces the user's opportunity to review the final PR title, description, and contents before they are published to a remote repository.
Audit Metadata