ai-agent-pr-metadata
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) to perform API calls for fetching comments and commits, and to post PR updates. These operations are scoped to the current repository using environment variables like$GITHUB_REPOSITORYand$PR_NUMBER. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection by ingesting and processing data from external, potentially untrusted sources.
- Ingestion points: The skill uses
gh apito download pull request and issue comments into temporary JSON files for subsequent processing. - Boundary markers: Instructions specify the use of hidden HTML markers (e.g.,
<!-- ocr-disposition:COMMENT_ID -->) to distinguish valid metadata and dispositions from general comment text. - Capability inventory: The skill has the capability to execute shell commands, run local Python scripts, and modify GitHub repository state through labels and comments.
- Sanitization: While the skill limits disposition recording to authorized users, it lacks explicit instructions for sanitizing or escaping external comment content before processing.
Audit Metadata