open-pr
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands using variables like
<branch>,<PR-number>, and<body>. This is standard for CLI automation but relies on the underlying platform's ability to safely handle variable interpolation within the shell environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository's git history to populate Pull Request metadata, which could potentially contain instructions aimed at the agent.
- Ingestion points: Commit messages are retrieved via
git logand used to generate PR titles and bodies inSKILL.md. - Boundary markers: No specific delimiters or "ignore" instructions are defined to separate ingested commit data from the agent's logic.
- Capability inventory: The skill utilizes
gitandghfor network operations (push,merge,create), file system modifications (rebase,checkout), and branch management. - Sanitization: The instructions suggest wrapping variables in double quotes for command execution, but do not specify comprehensive data validation or filtering.
Audit Metadata