external-pr-viability
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes the official GitHub CLI (
gh) to perform read-only queries of public repository information, specifically PR merge history and organization membership. These operations are conducted against a well-known service and do not involve sensitive data exfiltration or unauthorized access. - [INDIRECT_PROMPT_INJECTION]: The instructions involve reading external content like
CONTRIBUTING.mdandREADME.mdfrom third-party repositories. While this is a data ingestion surface, the skill is purely analytical and does not provide an execution path for malicious instructions contained within those files. - [COMMAND_EXECUTION]: The commands listed (
gh pr list,gh api) are standard development tools used for their intended purpose of information gathering. No dangerous shell injection or privilege escalation patterns were identified.
Audit Metadata