ai-agent-pr-metadata
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR comments and issues to verify governance rules.
- Ingestion points: Data is fetched via
gh apicalls inSKILL.md(e.g.,repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/comments) and saved to/tmp/files. - Boundary markers: The skill relies on specific metadata markers such as
<!-- ocr-disposition:COMMENT_ID -->to identify and process content. - Capability inventory: The agent has the ability to post PR comments (
gh pr comment) and apply labels to issues and pull requests. - Sanitization: While the skill mandates credential redaction, it does not explicitly detail the sanitization logic within the
verify-pr-governance.pyscript, leaving a potential surface where malicious instructions in comments could influence the labeling or audit process. - [COMMAND_EXECUTION]: The skill utilizes shell commands to interact with the GitHub API and execute local Python scripts.
- Evidence:
SKILL.mdcontains multiple bash blocks usinggh apito fetch repository data andpython3 support/ai-engineering-workflow/scripts/verify-pr-governance.pyto process the resulting JSON files. These operations are within the scope of the skill's intended purpose but involve execution of local scripts on external data.
Audit Metadata