make-pr
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from
git diffoutputs to automatically generate pull request titles and descriptions, which could be manipulated if an attacker embeds instructions within code comments or documentation. - Ingestion points: The skill reads output from
git diff <target>...HEADinSKILL.md(Step 2) to use as the primary source for drafting PR content. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded directives within the diff content provided to the agent.
- Capability inventory: The skill possesses the capability to perform
git pushand mutate Pull Requests (create and update) on remote platforms such as GitHub or GitLab inSKILL.md(Step 3). - Sanitization: The skill implements a verification step called a 'clean-room trace' in
SKILL.md(Step 2), requiring the agent to map every line of the draft to specific hunks in the diff and rewrite any 'untraced copy'. While this reduces the risk of hallucination or injection, it does not entirely eliminate the possibility of the agent following instructions embedded inside the diff.
Audit Metadata