prd-done
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to parse and execute shell commands embedded within Pull Request templates (e.g.,
.github/PULL_REQUEST_TEMPLATE.md). While it requires user confirmation before execution, this functionality allows for the execution of arbitrary commands defined in project documentation files. - Evidence: Section 3.5 explicitly instructs the agent to "Identify bash commands in code blocks that appear to be prerequisites" and "Propose and execute requirements: 'Should I execute these now?'".
- [PROMPT_INJECTION]: The skill ingests external data from Pull Request templates and PR comments, creating an attack surface for indirect prompt injection. Maliciously crafted content in these sources could attempt to influence the agent's behavior during the review and merge process.
- Ingestion points: PR templates and PR comments (including those from automated bots) retrieved via CLI or MCP servers.
- Boundary markers: The instructions do not define explicit delimiters to isolate untrusted external content from the skill's logic.
- Capability inventory: The agent has access to git commands, forge-specific CLI tools (gh, glab, tea), and the ability to execute bash commands extracted from templates.
- Sanitization: There is no specified validation or sanitization of content extracted from templates or comments before it is processed or executed.
Audit Metadata