ship-it
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
gh(GitHub) CLI to merge pull requests and verify their status (gh pr merge,gh pr view). These actions are standard for the described workflow and include specific flags to avoid bypassing repository branch protections. - [PROMPT_INJECTION]: The skill processes output from external command results (specifically PR metadata and CI results via
gh pr view). This represents an indirect prompt injection surface; however, the skill mitigates risk by requiring specific, verifiable states (e.g.,MERGED) before proceeding with any local file system changes. - [DEPENDENCIES]: The skill depends on sibling instruction files (
../checkout-commit-push-pr/SKILL.mdand../soft-delete-git/SKILL.md). These are resolved as local file paths within the skill's environment and do not involve remote downloads or untrusted code execution.
Audit Metadata