Skills
skills/oocx/tfplan2md-uat/create-pr-azdo/Gen Agent Trust Hub

create-pr-azdo

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local commands using git and the az CLI with the azure-devops extension. It specifically utilizes a repository-provided script at scripts/pr-azdo.sh to handle PR creation.
  • [COMMAND_EXECUTION]: A vulnerability surface for indirect prompt injection exists because user-controlled strings (PR title and description) are passed as arguments to shell commands.
  • Ingestion points: User-provided text for the PR title and description fields.
  • Boundary markers: None present to distinguish instructions from user-provided data.
  • Capability inventory: Shell execution of local scripts (scripts/pr-azdo.sh) and CLI tools (az, git).
  • Sanitization: No input validation or escaping is specified for user-provided data before interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 07:07 AM
Security Audit — agent-trust-hub — create-pr-azdo