setup-task-to-pr
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Uses system utilities such as git, rg (ripgrep), and find to perform read-only discovery of the repository structure and configuration files.
- [DYNAMIC_EXECUTION]: Generates and writes new SKILL.md instruction files based on project-specific templates. While this is the intended purpose, it involves the programmatic creation of agent instructions that the agent is further encouraged to self-patch.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted local files (e.g., package.json, README.md) to specialize generated instructions, creating a vector for malicious repository content to influence agent behavior.
- Ingestion points: Repository configuration and documentation files read during Phase 1.
- Boundary markers: None explicitly defined to isolate repo-sourced data within the generated skill instructions.
- Capability inventory: The generated skills are authorized to run shell commands, perform file operations, and manage git workflows.
- Sanitization: No validation or sanitization is performed on the content read from the repository before integration into new skills.
Audit Metadata