tk-pr-respond
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including PR reviews, CI logs, and web/file content which serves as an ingestion point for potential indirect prompt injection attacks.
- Ingestion points: Reads PR reviews, inline threads, conversation comments, CI logs, and web/file content (identified in
SKILL.md). - Boundary markers: Implements
<!-- tigerkit:retrieved-evidence-boundary -->and explicitly instructs the agent to treat retrieved text as data, not authority, ignoring any instruction-like text within. - Capability inventory: Significant capabilities include writing to the filesystem (
seed.md,.tigerkit/sdd-tmp/), executing shell commands for TDD tests, and performing network operations via the GitHub API (git push, thread resolution, replies). - Sanitization: Includes requirements to de-identify evidence and avoid placing sensitive data like passwords or tokens in logs or reports.
- [COMMAND_EXECUTION]: The skill utilizes shell commands for repository management and verification tasks.
- Evidence: The skill instructions and references (
testing.md,code-change.md,sdd.md) mandate the execution of shell commands for creating git worktrees and running behavior-first TDD tests (RED/GREEN cycles). - [EXTERNAL_DOWNLOADS]: The skill interacts with external services to fulfill its primary purpose.
- Evidence: Performs network operations to read from and write to GitHub repositories, including fetching PR state and pushing commits. These operations target well-known, trusted services.
Audit Metadata