create-pr
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Git commands, the GitHub CLI (
gh), and a specific local script.agents/scripts/create-pr.sh. These operations are well-defined within the scope of the skill's purpose and are restricted by theallowed-toolsconfiguration. - [DATA_EXFILTRATION]: While the skill's primary function is to publish code and metadata to a public repository, it includes exhaustive 'Confidentiality' instructions. These rules mandate that the agent scrub PII, secrets, unanonymized customer data, and internal-only information before committing code or opening a PR.
- [PROMPT_INJECTION]: The skill ingests untrusted data from git logs, branch names, and external issue trackers (JIRA and GitHub). This creates a surface for indirect prompt injection. The skill mitigates this by instructing the agent to never paste untrusted text directly and requiring the agent to obtain user confirmation for all generated titles, descriptions, and commit messages before execution.
Audit Metadata