pr
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bunfor project tasks (build, stylecheck) andbunxto run theoxfmtformatter. It also utilizes theghCLI for interacting with GitHub. All commands are standard for modern development workflows and aligned with the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill proactively addresses a potential vulnerability surface by requiring the pull request body to be written to a temporary file (e.g.,
/tmp/remotion-pr-body.md) and passed via the--body-fileflag of the GitHub CLI. This avoids the risk of shell injection that can occur when interpolating potentially untrusted or complex content directly into a command string.
Audit Metadata