git-pr-workflows-pr-enhance
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data from external sources.
- Ingestion points: The skill reads
git diffoutput, commit messages, and user-provided arguments inSKILL.mdandresources/implementation-playbook.md. - Boundary markers: There are no explicit instructions or delimiters telling the agent to ignore instructions that might be embedded within the processed code diffs or commit history.
- Capability inventory: The skill uses
subprocess.runto execute local shell commands and provides templates for generating comprehensive documentation based on external input. - Sanitization: There is no evidence of sanitization or filtering for the external data being interpolated into the agent's context.
- [COMMAND_EXECUTION]: The provided Python implementation playbook includes several instances of
subprocess.runused to execute git commands (e.g.,git diff,git shortstat). These scripts use variable interpolation for branch names ({base_branch}) which, if sourced directly from unsanitized user input, could lead to argument injection. This risk is mitigated by the fact that these are templates for the agent's internal operations rather than a public-facing API.
Audit Metadata