full-stop
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data from pull requests and source code. Because this data is used to drive the agent's automated proof, review, and testing steps, it provides a surface for indirect prompt injection.
- Ingestion points: The agent fetches target branches and inspects pull request metadata, including the PR head, base, checks, and reviewer outcomes (SKILL.md).
- Boundary markers: No specific boundary markers or instructions are provided to distinguish between authorized instructions and potentially malicious instructions embedded in the code or PR comments being processed.
- Capability inventory: The skill allows the agent to perform write operations (commit, push, rebase) and force-pushing. Crucially, it grants permission to use 'computer use' testing methods directly, bypassing project-level requirements to ask the user first (SKILL.md).
- Sanitization: There is no evidence of sanitization, validation, or escaping of the ingested pull request content or metadata before it is processed by the agent.
Audit Metadata