pr-creator
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external issue trackers, including task requirements and comments, to generate PR descriptions and identify work scope. A malicious actor with control over a tracker could inject instructions to influence the agent's behavior during the publication process.\n
- Ingestion points: Requirements and comments from GitHub and Jira trackers are read in the 'Recover and verify the task' section to determine implementation completeness.\n
- Boundary markers: The skill instructs the agent to 'Use only facts supported by the branch diff, commits, issue context, or the user's request' and 'Do not invent motivation', but it lacks explicit structural delimiters to isolate external tracker data from the system prompt.\n
- Capability inventory: The skill has the authority to perform 'git commit' and 'git push' operations, as well as create and update pull requests via the GitHub API.\n
- Sanitization: The instructions include verification steps, such as reading back the saved description and checking links, which serve as a limited validation mechanism.
Audit Metadata