pr-description-writer
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from git commit messages and code diffs to generate PR descriptions, which is a surface for indirect prompt injection.
- Ingestion points:
git logandgit diffoutputs are read into the agent's context (SKILL.md). - Boundary markers: The skill includes a mandatory human-in-the-loop approval step, requiring the user to review the title and body before any execution (SKILL.md).
- Capability inventory: The skill has the ability to execute
git pushandgh pr create, which can modify remote repositories (SKILL.md). - Sanitization: The skill writes the PR body to a temporary file to prevent shell escaping issues and uses quoted heredocs in scripts (SKILL.md).
- [COMMAND_EXECUTION]: The skill executes shell commands (e.g.,
gh pr create) using variables such as the PR title and base branch name derived from the repository's state. While mitigated by mandatory user review and the use of temporary files for the main body, the interpolation of these strings into shell commands presents a potential command injection surface.
Audit Metadata