pr-craft
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform Git operations (branching, staging, committing, and pushing) and GitHub CLI operations (creating PRs and managing stacks). While these are the core functions of the skill, they involve executing shell commands that modify and transmit repository code.\n- [EXTERNAL_DOWNLOADS]: The skill directs the agent to install the
gh-stackextension from the officialgithuborganization using the commandgh extension install github/gh-stackinSKILL.mdandEXAMPLE.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes code changes that could contain malicious instructions designed to influence the pull request description or agent behavior.\n - Ingestion points: External code content is ingested via
git diffandgit statusin the inspect and size-measuring steps ofSKILL.md.\n - Boundary markers: The instructions do not specify any boundary markers or special handling to separate instructions from the data being analyzed in the diffs.\n
- Capability inventory: The skill has the capability to write to the local filesystem (git commit), interact with the network (git push, gh pr create), and install extensions.\n
- Sanitization: There are no explicit sanitization or filtering steps defined to process the ingested diff data before it is used to generate the structured PR body.
Audit Metadata