pr-checklist
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development tools to inspect the repository and verify changes. Evidence includes the use of
git status,git diff,git log,mvn test,mvn jacoco:report,python -m pytest,yarn test, andyarn playwright:runinSKILL.md. All commands are targeted at the project's own codebase and are necessary for the skill's stated purpose of PR preparation. - [COMMAND_EXECUTION]: The skill interacts with the GitHub API via the official CLI tool. It executes
gh issue view,gh pr create, andgh pr editto manage pull requests and linked issues based on human-verified drafts. - [PROMPT_INJECTION]: As a developer tool that processes repository content, it has an inherent surface for indirect instructions embedded in code or issue data. The skill ingests data from
git diff,git log, andgh issue view. To mitigate risk, it explicitly uses shell HEREDOCs (cat <<'EOF') to safely encapsulate generated PR bodies, which prevents the shell from interpreting the content as commands. The generated content is presented for human review before the PR is created.
Audit Metadata