merge-pr
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates standard git workflows including merging pull requests and managing worktrees using the official GitHub CLI and Git. All operations, such as rebase, push, and cleanup, are consistent with routine developer tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Pull Request metadata, which is a requirement for its core functionality.
- Ingestion points: Pull Request titles, bodies, and status checks are retrieved via
gh pr view,gh pr checks, andgh apicalls inSKILL.md. - Boundary markers: Not explicitly used to isolate external content from instructions.
- Capability inventory: Includes repository and file system modifications via
git push,gh pr merge, andgit worktree remove. - Sanitization: Relies on standard shell quoting for variable interpolation.
Audit Metadata