pr
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository artifacts to generate PR reports, making it susceptible to malicious instructions embedded in the code or diffs being analyzed.
- Ingestion points: The agent is instructed to read the full relevant diff, committed/staged/unstaged changes, and included untracked files (SKILL.md, Section 2).
- Boundary markers: The skill does not mandate specific technical delimiters to isolate untrusted content during prompt interpolation.
- Capability inventory: The agent has the ability to use Git for local repository management and the
gh(GitHub CLI) for creating or updating pull requests (references/publication.md). - Sanitization: The instructions require the agent to sanitize public content and report evidence gaps without exposing private logs (SKILL.md, Section 4).
- [COMMAND_EXECUTION]: The skill utilizes command-line tools like
gitandghto perform its core functions. These tools are used for legitimate repository inspection and PR publication, but they represent a powerful capability set that is constrained by the skill's requirements for explicit project authority and read-back verification steps.
Audit Metadata