multi-repo
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests untrusted data and possesses exploitable capabilities.
- Ingestion points: In SKILL.md, Operation 3 clones or fetches external repositories and reads file contents such as API specifications and schemas to detect breaking changes.
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore embedded prompts within the external data being processed.
- Capability inventory: The skill utilizes git for branching and worktree management and the gh CLI for creating and merging pull requests across repositories.
- Sanitization: The instructions do not specify any sanitization or validation of external content before the agent interprets it.
Audit Metadata