write-visual-pr
Fail
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes an unsafe shell pattern
$(cat .scratchpad/<slug>/pr-body.md)to pass the Pull Request description to theglab mr createandglab mr updatecommands. Since the content of the scratchpad file is derived from untrusted repository data such as git logs and diffs, this construct allows for arbitrary shell command injection if the repository data contains shell-special characters (e.g., backticks, dollar signs, or semicolons). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from the repository, specifically using
git logandgit diff. There are no boundary markers or sanitization steps mentioned for this ingested data, which increases the risk that malicious instructions embedded in commit messages or code changes could influence the agent's behavior or exploit the command injection vulnerability described above.
Recommendations
- AI detected serious security threats
Audit Metadata