pr-create
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development and version control commands, including
gitandgh(GitHub CLI), as well as project-defined scripts for linting and testing (e.g.,npm run lint,pytest). These operations are restricted to commands already defined in project configuration files to mitigate risk.\n- [INDIRECT_PROMPT_INJECTION]: The skill features a surface area for indirect prompt injection by processing external data from CI logs and GitHub API responses.\n - Ingestion points: Ingests untrusted data from GitHub CI logs (
gh run view --log-failed), repository configuration files (CLAUDE.md,package.json), and GitHub API responses.\n - Boundary markers: Employs explicit security boundaries in the instructions, directing the agent to ignore any off-topic commands found in external sources and to only run commands defined in committed configuration files.\n
- Capability inventory: The agent can modify code, commit changes, push to remote branches, and manage pull requests on GitHub.\n
- Sanitization: Relies on instructional constraints to prevent obedience to embedded commands and to ensure that sensitive information like environment variables is not leaked in commit messages or PR descriptions.
Audit Metadata