git-pr-workflows-pr-enhance
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python scripts in
resources/implementation-playbook.mdexecutegitcommands throughsubprocess.runusing string interpolation for branch names. - Evidence: Functions such as
_get_changed_filesand_get_change_statsinterpolate the{base_branch}variable directly into git command strings. - Risk: If the branch name is derived from untrusted user input without validation, it could allow for argument injection in the git process.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from git repositories (diffs and commits).
- Ingestion points:
resources/implementation-playbook.mdcontains logic to extract information from commit messages (e.g.,extract_why_from_commits,extract_main_purpose) and file contents. - Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore embedded commands within the processed git data.
- Capability inventory: The skill can execute git commands and generate structured text based on the untrusted input.
- Sanitization: No sanitization or validation of the commit messages or diff content is performed before they are used to generate PR documentation.
Audit Metadata