pr-writer
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface. It reads untrusted data from the local repository and incorporates it into agent-generated content that is then executed via the GitHub CLI.
- Ingestion points: The skill executes
git log BASE..HEADandgit diff BASE...HEADinSKILL.mdto analyze changes for the PR description. - Boundary markers: None are used to separate the untrusted diff/log content from the agent's instructions.
- Capability inventory: The skill has the ability to write to the repository's GitHub presence using
gh pr createandgh api -X PATCHinSKILL.md. - Sanitization: There is no evidence of filtering or sanitizing the git output before it is processed by the LLM to generate the PR body. An attacker could place malicious instructions in commit messages or code comments that might influence the agent's behavior during pull request creation.
Audit Metadata