pr-verdict
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from external sources, specifically Pull Request titles, descriptions, and code changes. This creates a surface for indirect prompt injection where an attacker could embed instructions in a PR to influence the agent's verdict or behavior.
- Ingestion points: The skill reads the PR title, description, and head commit code as claims to be verified (SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the ingested PR content as untrusted data or to ignore instructions contained within it.
- Capability inventory: The skill analyzes PRs and provides recommendations; it explicitly requires user confirmation before applying labels ("Apply the label only when the user says so"), which serves as a security checkpoint.
- Sanitization: No sanitization or validation of the PR content is performed before processing.
Audit Metadata