prepare-for-review
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple local CLI tools including
git,gh(GitHub CLI), andagent-browser. It also dynamically generates a shell script at.scratch/<feature>/screenshots.shbased on user-supplied URLs and framework conventions to automate screenshot capture. Potential risks from shell interpolation are mitigated by kebab-case transformation of slugs and an explicit human-in-the-loop preview and approval step before execution. - [DATA_EXFILTRATION]: The skill reads repository data (git diffs, commit logs, internal documentation) and transmits it to GitHub's infrastructure via
gh pr createandgh api. This behavior is the primary intended function of the skill and targets the user's configured remote origin. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted data from the repository (such as commit messages or documentation files) and interpolates them into the agent's context to generate a PR body. This is mitigated by the 'Preview' step which requires explicit user approval of the generated content before submission.
- [EXTERNAL_DOWNLOADS]: The skill references an external CLI tool,
agent-browser, and instructions for it are fetched viaagent-browser skills get core. This is documented as a prerequisite for the frontend screenshot functionality.
Audit Metadata