open-pr
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external sources which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: The skill reads the repository's PR template from
.github/PULL_REQUEST_TEMPLATE.mdin SKILL.md and retrieves pull request reviews from the Significant-Gravitas/AutoGPT repository using thegh apicommand. - Boundary markers: No explicit delimiters or instructions are provided to ensure the agent disregards instructions embedded within the ingested template or review comments.
- Capability inventory: The skill utilizes sensitive capabilities including
git push,gh pr create, andgh pr comment, which could be abused if the agent is influenced by injected content. - Sanitization: There is no evidence of sanitization, filtering, or validation of the fetched PR template or API-sourced review content before it is processed by the agent.
Audit Metadata