autonomous-pr-driver
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests and processes content from GitHub Pull Request comments and review threads, which are untrusted external inputs. This exposure creates a surface for indirect prompt injection attacks. \n
- Ingestion points: reviewThreads and issue comments are fetched using GitHub API calls in
reference/triage-playbook.md. \n - Boundary markers: The skill provides clear boundary instructions in the
SKILL.md'Safety' section, explicitly telling the agent to treat review text as untrusted data and not as instructions to be followed. \n - Capability inventory: The skill utilizes the
ghCLI for repository interaction and has the capability to run local shell commands and scripts (e.g.,node,python,grep) for verification. \n - Sanitization: Mitigation is implemented through a 'Verify-before-trust' requirement and a strict prohibition against executing code from untrusted forks.
Audit Metadata