sending-pull-request
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands using
gitandgh(GitHub CLI) to manage branches, push code to remote repositories, and interact with the GitHub API for pull request creation and updates. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from the repository, including git history and code diffs, which acts as an untrusted data source that could influence agent behavior during PR generation.
- Ingestion points: The skill reads git commit messages, code diffs against the default branch, and repository documentation (README, CHANGELOG.md) to generate PR titles, bodies, and evidence.
- Boundary markers: There are no explicit instructions or delimiters used to isolate untrusted commit messages or code contents from the agent's instructions, potentially allowing adversarial content in a diff to manipulate the PR description output.
- Capability inventory: The skill possesses the ability to write to the local filesystem (temporary body files), execute shell commands (
git,gh), and perform network operations (pushing code and PR updates). - Sanitization: While
MEDIA.mdprovides instructions to redact credentials and personal information from text evidence, there is no specific sanitization or filtering logic applied to the natural language content extracted from commits or diffs to prevent prompt injection.
Audit Metadata