ship
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data by reading Pull Request review comments and summaries via 'gh pr view', 'gh pr review', and 'gh api graphql'.
- Ingestion points: Untrusted content enters the agent context through GitHub CLI commands that fetch PR comments and review threads as described in the 'Establish PR state' and 'Start the shipping loop' sections of SKILL.md.
- Boundary markers: The instructions do not define explicit boundary markers or 'ignore' directives to separate external comment content from the agent's core instructions.
- Capability inventory: The skill has broad capabilities including local file modification, executing 'git push', and performing 'gh pr merge' as detailed in the 'Handling Automated Review Comments' and 'Merge' sections.
- Sanitization: No explicit sanitization or filtering of external content is performed; the skill relies on the agent's ability to 'Decide if the comment is valid' based on the surrounding code context. While this reasoning step provides a layer of defense, the processing of potentially adversarial instructions alongside code-writing and repository-modification capabilities constitutes an indirect prompt injection surface.
Audit Metadata