open-pr
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including
git,gh,jq, andsedto manage the local worktree and interact with the GitHub API. These tools are used to commit changes, push branches, and automate the PR lifecycle. - [PROMPT_INJECTION]: The skill incorporates external data from repository configuration, GitHub issues, and previous step summaries, creating a surface for indirect prompt injection.
- Ingestion points: Content is ingested from
.ai/agentic.config.json, GitHub issue metadata, and theapply-fixstep's summary output. - Boundary markers: The skill uses delimiters like
— PREVIOUS STEP (apply-fix) said —to frame external content. - Capability inventory: The skill can execute shell commands, modify the repository state, and perform authenticated GitHub API calls to create PRs and comment on issues.
- Sanitization: There is no evidence of explicit sanitization or escaping of the external data before it is interpolated into PR bodies or titles.
Audit Metadata