finish-line
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill has an indirect prompt injection attack surface because it ingests untrusted data from pull request titles, descriptions, and comments while possessing the capability to execute commands that modify the repository state.
- Ingestion points: External data enters the context via
gh pr view,gh pr diff, andgh pr view --commentsinSKILL.md. - Boundary markers: The skill lacks explicit instructions for the agent to treat the pull request content as untrusted or to use delimiters to isolate external text from system instructions.
- Capability inventory: The agent is granted capabilities to perform impactful actions such as
git push,gh pr comment,gh pr close, and branch management as defined inSKILL.md. - Sanitization: There is no defined process for validating user-supplied arguments or sanitizing pulled content before it is processed or used to generate repository changes.
Audit Metadata