pr-maintainer
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the external environment which can be manipulated by an attacker to influence the agent's behavior.
- Ingestion points: The skill fetches pull request comments via
gh apiand reads failed CI logs usinggh run view --log-failedto identify necessary code repairs. - Boundary markers: The instructions lack specific delimiters or "ignore embedded instructions" warnings for the ingested text, making it possible for malicious content to be interpreted as agent commands.
- Capability inventory: The agent has high-impact capabilities including writing code, pushing commits to the repository, and merging pull requests via
gh pr merge. - Sanitization: While the skill asks the agent to "decide whether each finding is valid," there is no technical validation, filtering, or sanitization performed on the ingested data before it is processed by the LLM.
Audit Metadata