finalize
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Git and GitHub CLI (gh) to perform repository management tasks such as merging, pushing, and branch cleanup. These actions are restricted to user-authorized operations and governed by specific prohibitions against unsafe flags like --force, --admin, or reset --hard.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files, commit messages, and forge (GitHub) output to generate Pull Request content. The attack surface is managed by explicit instructions to treat such data as non-instructional and to sanitize credentials.
- Ingestion points: Data is gathered from git log, gh pr view, and various status commands in the repository.
- Boundary markers: The skill's security model explicitly defines commit messages and PR text as untrusted data that must not override the agent's instructions.
- Capability inventory: The skill has file system access and network capabilities (git push, gh pr merge), but these are gated by user confirmation and prohibit bypass flags.
- Sanitization: The skill mandates that credentials, tokens, and environment variables are excluded or replaced with placeholders in generated PR content.
Audit Metadata