approve-pr
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR comments and review threads, creating a surface for indirect prompt injection.
- Ingestion points: The skill fetches review threads via GraphQL and consumes verdict recommendations from the
verify-prskill. - Boundary markers: The instructions explicitly mandate the use of quoted heredocs (
<<'EOF') for all review bodies to prevent the agent from accidentally executing commands that might be contained within PR text. - Capability inventory: The skill has the ability to submit PR reviews, approvals, and initiate merges through the
ship-prskill. - Sanitization: It utilizes specific GitHub CLI flags (
-F) for GraphQL parameters and quoted shell heredocs to isolate external content from the execution environment. - [COMMAND_EXECUTION]: The skill utilizes dynamic context placeholders (
!command) at load time to gather repository metadata such as the repository name, default branch, and current user login. These commands are read-only and limited to the local development environment and official GitHub APIs. All subsequent state-changing operations are performed via the GitHub CLI using secure execution patterns.
Audit Metadata