tidb-pr-metadata-guard
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes pull request bodies which can contain content from external, untrusted contributors.
- Ingestion points: The agent reads existing PR descriptions and repository templates (
.github/pull_request_template.md) from the environment or via the GitHub CLI. - Boundary markers: The instructions do not define clear delimiters or "ignore instructions" tags when the agent is handling the contents of a PR body.
- Capability inventory: The skill provides the agent with the ability to create and update pull requests on GitHub using the
ghcommand-line tool. - Sanitization: While the workflow recommends materializing the body to a local file for review before submission, there is no technical sanitization or filtering to prevent the agent from acting on instructions embedded within a PR description.
Audit Metadata