merge-pr
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the GitHub CLI (
gh) and Git to perform operations like viewing PR metadata, adding labels, and merging code. These are standard operations for development workflows. - [SAFE]: The skill implements logic to honor project-specific configuration (e.g.,
human_merge_required). It also includes thedisable-model-invocation: truedirective, which ensures the AI agent does not recursively process potentially malicious instructions embedded in pull request titles or comments, mitigating indirect prompt injection risks.
Audit Metadata