commit-pr
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Uses git and gh CLI tools to manage repository state and create pull requests. These are standard operations for development workflows.
- [PROMPT_INJECTION]: Processes untrusted data from git history to generate PR descriptions. It employs literal shell heredocs to prevent this content from being interpreted as commands. Ingestion points: git log and git diff outputs. Boundary markers: Shell heredoc delimiters. Capability inventory: Git and GitHub CLI subprocess execution. Sanitization: Literal heredoc usage.
Audit Metadata