create-production-pr
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub Pull Request bodies via the
gh pr viewcommand to automatically determine which issues should be closed upon merging the production promotion PR. - Ingestion points: External data from the repository (PR bodies and commit messages) enters the agent's context during the discovery phase in Step 5 of the workflow.
- Boundary markers: The instructions do not use explicit delimiters to separate external content from instructions, though they attempt to define logical boundaries by specifying allowed keywords.
- Capability inventory: The skill is granted the capability to write to the repository by creating new Pull Requests (
gh pr create) and can perform broad read operations via the GitHub API. - Sanitization: The skill provides a form of logic-based sanitization by instructing the agent to only act on explicit "closing magic words" and to ignore IDs found in prose or non-closing contexts. This reduces the risk of accidental triggers but does not fully prevent an adversary from intentionally including malicious keywords in a PR body to influence the promotion process.
Audit Metadata