pr
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh pr create) to automate pull request creation based on agent-generated content.- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to read and summarize external data that could be controlled by an attacker. - Ingestion points: The agent reads git commit messages and file diffs to generate summaries (SKILL.md).
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious instructions embedded within the git history or code changes.
- Capability inventory: The skill executes shell commands using the
ghtool, which can interact with remote repositories (SKILL.md). - Sanitization: There is no evidence of sanitization or filtering logic to prevent the agent from following instructions found within the diffs or commit messages.
Audit Metadata