close-effort
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon data from external, untrusted sources which could contain malicious instructions.
- Ingestion points: The agent is directed in
SKILL.md(Step 3) to "Read the pull request's description and the handoff for what the delivery left open: follow-ups, checks it skipped and decisions for the maintainer. Run the skipped checks now." - Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat this external content as untrusted data or to ignore any embedded system-level instructions.
- Capability inventory: The agent has access to powerful tools including the GitHub CLI (
gh) for merging PRs and creating issues, and thegitcommand for branch management and file operations. - Sanitization: The skill lacks any instructions for sanitizing or validating the content found in pull request descriptions or handoff notes before processing them as instructions.
Audit Metadata