pr-to-ready
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design, as it must ingest and process untrusted external data to perform its primary function.
- Ingestion points: The skill reads external content from
SKILL.md(Workflow section), including PR titles, bodies, review submissions, unresolved threads, and bot comments. - Boundary markers: The instructions do not specify the use of delimiters (like XML tags or triple quotes) or explicit "ignore embedded instructions" warnings when processing the content of PR comments or reviews.
- Capability inventory: The agent has high-privilege capabilities including modifying source code ("Patch only actionable findings"), executing shell commands for verification ("Run the smallest verification"), and performing network operations to external APIs ("Sync the linked Linear ticket").
- Sanitization: There is no mention of sanitizing, escaping, or validating the input from PR comments before it influences the agent's logic for code editing or command execution.
Audit Metadata