to-pr
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from repository content. 1. Ingestion points: Git status, commit history, and diffs are read from the local repository (SKILL.md). 2. Boundary markers: The skill does not use delimiters to isolate untrusted code or commit data from the instruction context. 3. Capability inventory: The skill can push branches to remote origins and create Pull Requests via GitHub APIs or CLI (SKILL.md). 4. Sanitization: No sanitization of the ingested git content is performed before summary generation.
Audit Metadata