tk-pr-rebase
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains 'Approval Continuity' logic instructions that explicitly tell the agent to 'Ask only for a new material decision' and 'not repeat that approval question' once an initial scope is approved. This allows the agent to move through high-risk phases (implementation, verification, and remote publication) without turn-by-turn confirmation, effectively bypassing standard per-action oversight for long-running workflows.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which serves as an attack surface for indirect prompt injection.
- Ingestion points: GitHub Pull Request descriptions, review comments, thread content, and commit metadata (via
rebase-readiness.md). - Boundary markers: The instructions do not define clear delimiters or 'ignore' warnings for the content read from external PRs.
- Capability inventory: The skill can execute Git mutations (
rebase,worktree), resolve conflicts, and perform remote writes (push --force-with-lease). - Sanitization: No sanitization of PR description or comment text is specified before the agent processes it to determine rebase intent or status.
- [COMMAND_EXECUTION]: The skill executes local system commands through Git (e.g.,
git worktree,git fetch,git rebase,git push) and runs a local scriptscripts/durable_artifacts.py. These commands are parameterized by data fetched from remote repositories, which could be manipulated by an attacker with write access to the target PR.
Audit Metadata