pr-automate
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a data ingestion surface by monitoring and relaying external text from GitHub Pull Request comments.
- Ingestion points: Step 4 of the procedure involves polling for new reviews or comments on the PR (found in
SKILL.md). - Boundary markers: The instructions do not specify the use of explicit delimiters or instructions to ignore embedded commands within the relayed content.
- Capability inventory: The skill utilizes the
ghCLI and development-related tools (lint,test,review). - Sanitization: The procedure indicates that feedback should be relayed verbatim to the main agent without additional filtering.
- Context: The surface is mitigated by explicitly scoping feedback collection to authorized handles (
seabbsandseabbs-bot), which align with the skill's author context.
Audit Metadata