release-cherry-pick
Warn
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs direct shell interpolation of variables such as
<VERSION>and pull request metadata (<NUM>,<SHA>) into commands likegit checkout,git push, andgh pr view. This creates a command injection risk where crafted input could execute arbitrary shell commands. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting and acting upon untrusted data from the GitHub API.
- Ingestion points: Pull request titles and metadata fetched via
gh apiin Step 2. - Boundary markers: None identified; the data is used directly in subsequent commands.
- Capability inventory: The skill possesses significant capabilities including local filesystem modification via
gitand remote repository modification viagh(creating PRs, editing labels, pushing branches). - Sanitization: No sanitization or validation of the fetched PR titles or numbers is performed before they are included in the
gh pr createandgh pr editcommands in Steps 6 and 7.
Audit Metadata