pr
Warn
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to extract a base branch name directly from
$ARGUMENTSand use it in shell commands such asgh pr create --base <base>. If the user-supplied arguments contain shell metacharacters (e.g.,;,&&,|), they could be executed as arbitrary commands on the local system. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository environment to summarize changes and proofread content, creating a vulnerability surface where malicious commit messages or code diffs could influence agent behavior.
- Ingestion points: Repository history (
git log), code changes (git diff), pull request templates (pull_request_template.md), and branch/issue metadata. - Boundary markers: Absent. The skill does not define delimiters or specific instructions to isolate repository data from the agent's primary directives.
- Capability inventory: The skill possesses the capability to push code to remote repositories (
git push), create new pull requests (gh pr create), and make authenticated requests to the GitHub API (gh api), representing a high-impact surface for malicious manipulation. - Sanitization: No validation or sanitization of repository-sourced content is performed before processing.
Audit Metadata