publish-open-pr
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The workflow involves the execution of a local Python script,
scripts/render_pr_bundle.py, which is used to process repository data and prepare the pull request package. - [COMMAND_EXECUTION]: The skill executes multiple shell commands using
gitand the GitHub CLI (gh) to verify authentication status, check repository state, and perform network operations such as pushing branches and creating pull requests. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it ingests and processes untrusted data from external sources.
- Ingestion points: Data is read from the linked GitHub issue's metadata, branch names, commit messages, and local validation results.
- Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential injections within the issue metadata or commit content.
- Capability inventory: The skill has the capability to write to external systems via
git pushandgh pr create. - Sanitization: There are no explicit sanitization or validation steps described for the data interpolated into the PR title and body artifacts.
Audit Metadata