pr-layer-map
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
gitandgh(GitHub CLI) commands via a Python script to retrieve pull request data and local repository history. These commands are executed using argument lists withsubprocess.run, which mitigates shell injection vulnerabilities. The script is used for legitimate repository analysis. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process pull request metadata, including the PR body, which is untrusted content provided by external authors. This creates a surface for indirect prompt injection attacks.
- Ingestion points: The pull request body is fetched from the GitHub API using the GitHub CLI in
scripts/classify_changes.pyand is presented to the agent for analysis as described inSKILL.md. - Boundary markers: The skill does not employ specific delimiters or instructions to the agent to ignore potentially malicious content within the PR body.
- Capability inventory: The skill can execute local development tools (
git,gh) and present summarized architectural data to the user. - Sanitization: There is no evidence of sanitization or filtering performed on the PR body content before the agent skims it for context.
Audit Metadata