github-pr
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository-specific files, creating a potential vector for indirect prompt injection attacks.
- Ingestion points: The skill reads content from
AGENTS.md,CONTRIBUTING.md, and various pull request template locations (e.g.,.github/pull_request_template.md,docs/pull_request_template.md) to define its operational context and PR body content. - Capability inventory: The skill possesses write capabilities through
git pushand GitHub CLI operations (gh pr create,gh pr edit,gh pr ready) as outlined inreferences/operations.md. - Boundary markers: There are no explicit delimiters or specific 'ignore embedded instructions' warnings defined for when the agent ingests content from these repository files, although it is instructed to inspect the final output before submission.
- Sanitization: The instructions require the agent to manually exclude secrets and private data, but there is no automated validation or sanitization of the input retrieved from the external configuration files.
Audit Metadata