ship-subissue
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub pull requests which could contain malicious instructions aimed at overriding agent logic during the merge and review process.\n
- Ingestion points: The workflow executes
gh pr viewin SKILL.md, bringing external PR descriptions and comments into the agent's context.\n - Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within the ingested PR data.\n
- Capability inventory: The skill possesses the capability to modify repository state via
gh pr mergeandgh issue close.\n - Sanitization: No sanitization or validation of the PR content is performed before the agent evaluates whether the target is correct and the review is clean.\n- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) to interact with remote repositories. The commands used (gh pr view,gh pr merge,gh issue close) are standard for the skill's stated purpose but involve interaction with external systems based on potentially untrusted input.
Audit Metadata