ship
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest validation signals and command outcomes to generate pull request descriptions, creating a surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read recent validation signals and command summaries into its context (SKILL.md).
- Boundary markers: The workflow does not define specific delimiters or instructions to treat the validation signals as untrusted data.
- Capability inventory: The skill uses the
ghCLI to perform network operations and write data to remote GitHub repositories (SKILL.md). - Sanitization: There are no instructions for sanitizing or escaping the content of the validation signals before they are interpolated into the PR description.
Audit Metadata