pr-readiness
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes external system binaries, specifically
gh(GitHub CLI) andgit, to perform repository operations, fetch PR metadata, and transition PR states. These calls are made usingexecFileSyncwith argument arrays, which prevents shell injection, but the functionality allows the agent to execute these tools with user-provided parameters like repository names and branch references. - [INDIRECT_PROMPT_INJECTION]: The skill implements logic to parse pull request bodies for embedded JSON metadata wrapped in HTML comments (
<!-- pr-readiness: ... -->). This creates an attack surface where untrusted data (the PR body) can influence the skill's decision-making process. - Ingestion points: Pull request bodies are fetched via the forge adapter in
scripts/adapters.tsand processed inscripts/cli.tsandscripts/evaluator.ts. - Boundary markers: The skill looks for specific markers (the
## Evidencesection and<!-- pr-readiness: ... -->comments) to delimit the instructions within the PR body. - Capability inventory: The skill has the capability to write files to the local disk (
FilePacketStore) and modify external PR states through the GitHub API using the forge adapter. - Sanitization: The skill validates the extracted metadata using
JSON.parseand checks it against internal rules and observation IDs, providing a layer of protection against malformed or unauthorized claims.
Audit Metadata