pr-craft

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform Git operations (branching, staging, committing, and pushing) and GitHub CLI operations (creating PRs and managing stacks). While these are the core functions of the skill, they involve executing shell commands that modify and transmit repository code.\n- [EXTERNAL_DOWNLOADS]: The skill directs the agent to install the gh-stack extension from the official github organization using the command gh extension install github/gh-stack in SKILL.md and EXAMPLE.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes code changes that could contain malicious instructions designed to influence the pull request description or agent behavior.\n
  • Ingestion points: External code content is ingested via git diff and git status in the inspect and size-measuring steps of SKILL.md.\n
  • Boundary markers: The instructions do not specify any boundary markers or special handling to separate instructions from the data being analyzed in the diffs.\n
  • Capability inventory: The skill has the capability to write to the local filesystem (git commit), interact with the network (git push, gh pr create), and install extensions.\n
  • Sanitization: There are no explicit sanitization or filtering steps defined to process the ingested diff data before it is used to generate the structured PR body.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 06:05 PM