create-pr-text
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issues and local project files to generate pull request text, which could contain adversarial instructions targeting the agent.
- Ingestion points: The skill uses the
gh issue viewcommand to fetch external content from GitHub. It also reads local files likeplan.md,report.md, andimplementation-notes.mdinSKILL.mdstep 2. - Boundary markers: There are no explicit instructions or delimiters defined to isolate the external issue content or warn the agent to ignore instructions embedded within the fetched text.
- Capability inventory: The skill is granted access to the
Bash,Write,Read,Glob, andGreptools. This allows the agent to execute shell commands and modify the local filesystem based on the processed data. - Sanitization: The instructions do not specify any validation, escaping, or filtering for the external content before it is processed or written to
pr.md.
Audit Metadata