finish-pr
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from pull request comments, review threads, and repository-native documentation to drive its automation logic.
- Ingestion points: Data enters the context via
gh pr viewand theget-unresolved-pr-threads.ps1script which fetches all PR comments and reviews from external users. - Capability inventory: The skill has the authority to perform file system writes,
git commit,git merge, andgit pushoperations, as well as interacting with the GitHub API to post replies. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between its own system instructions and potentially malicious commands embedded within the external PR data.
- Sanitization: The skill relies on the agent's interpretation of feedback and does not implement technical sanitization or validation of the input strings before they influence repository changes or API calls.
Audit Metadata