pr-create
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the processing of untrusted repository data.
- Ingestion points: The agent executes
git logandgit diffto gather context for generating PR titles and descriptions. These sources can contain attacker-controlled content if a malicious contributor submits code or commit messages designed to influence the agent's behavior. - Boundary markers: The instructions do not define clear delimiters or instruct the agent to ignore instructions embedded within the git logs or code diffs.
- Capability inventory: The skill has the capability to execute shell commands (
git,gh) and write data to external platforms (GitHub) via thegh pr createcommand. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from git history before it is used to construct the PR body or title.
Audit Metadata