pr-evidence
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted content from various sources, which could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: The skill reads the PR intent, diff, body, task evidence, checks, and live preview states (e.g., website content at a preview URL).
- Boundary markers: There are no explicit instructions to treat the ingested data as untrusted or to ignore any embedded instructions (e.g., markdown comments or hidden text in the diff).
- Capability inventory: The agent has the authority to modify PR bodies and upload files to external tools.
- Sanitization: The instructions do not specify any validation or sanitization steps for the data retrieved from PRs or external URLs.
- [DATA_EXFILTRATION]: The skill instructions mandate uploading repository artifacts or generated files to an external service using the
vitehub-droptool to facilitate downloads. This results in the transfer of potentially sensitive repository content to an external platform.
Audit Metadata