merge-queue
Warn
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads configuration from
~/.config/orchestrate/<repo>.env. Accessing files with the.envextension, particularly in a user-level configuration directory, poses a risk of exposing environment variables or credentials stored in that location. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PRs, creating an attack surface for indirect prompt injection.
- Ingestion points: Reads PR labels (
waits:), commit messages (checking for "credit an AI"), and PR file contents. - Boundary markers: No explicit instructions or delimiters are used to isolate untrusted PR data from the agent's logic.
- Capability inventory: Executes shell scripts (
orch-*), Git operations, and GitHub CLI commands. - Sanitization: No validation or sanitization is mentioned for content retrieved from external PRs or commit logs.
- [COMMAND_EXECUTION]: The skill executes external bash scripts (
orch-greenwatch,orch-mergecheck, etc.) and system CLI tools (git,gh). While necessary for merge operations, this pattern relies on the security of the local path and the safe handling of variables within those scripts.
Audit Metadata