auto-pr-pipeline
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically identifies and executes build, test, and linting scripts based on configuration files found within the local repository, such as
package.json,Makefile,pyproject.toml, and CI workflow files. This behavior allows the execution of arbitrary commands defined in the codebase being processed. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted external data including Pull Request comments, review decisions, and code changes, which serves as a vector for indirect instructions.
- Ingestion points: The agent reads branch metadata, PR review comments, and file content during the snapshot and review-fix phases (defined in
SKILL.mdandreferences/repo-detection.md). - Boundary markers: The instructions emphasize following repository policies and specific scopes, but there are no explicit delimiters or instructions to ignore potential commands embedded in PR comments.
- Capability inventory: The skill has high-privilege capabilities including
git commit,git push,gh pr merge, and the execution of local shell commands for validation. - Sanitization: There is no evidence of sanitization or filtering applied to external PR comment text before it is used to influence the agent's decision engine.
- [COMMAND_EXECUTION]: The skill utilizes the shell to run repository-native checks and GitHub CLI commands to manage the delivery pipeline.
Audit Metadata