approve-pr

Pass

Audited by Gen Agent Trust Hub on Aug 2, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR comments and review threads, creating a surface for indirect prompt injection.
  • Ingestion points: The skill fetches review threads via GraphQL and consumes verdict recommendations from the verify-pr skill.
  • Boundary markers: The instructions explicitly mandate the use of quoted heredocs (<<'EOF') for all review bodies to prevent the agent from accidentally executing commands that might be contained within PR text.
  • Capability inventory: The skill has the ability to submit PR reviews, approvals, and initiate merges through the ship-pr skill.
  • Sanitization: It utilizes specific GitHub CLI flags (-F) for GraphQL parameters and quoted shell heredocs to isolate external content from the execution environment.
  • [COMMAND_EXECUTION]: The skill utilizes dynamic context placeholders (!command) at load time to gather repository metadata such as the repository name, default branch, and current user login. These commands are read-only and limited to the local development environment and official GitHub APIs. All subsequent state-changing operations are performed via the GitHub CLI using secure execution patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 2, 2026, 06:14 AM
Security Audit — agent-trust-hub — approve-pr