branch-pr
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill documents a legitimate development workflow focused on Pull Request organization and linting. There are no signs of malicious intent or hidden instructions.
- [COMMAND_EXECUTION]: The workflow involves executing standard command-line tools including
gitfor version control,ghfor GitHub interactions, andshellcheckfor script linting. These are routine development activities within the intended scope of the skill. - [PROMPT_INJECTION]: The skill processes data from GitHub (issues and PR templates), which constitutes an indirect prompt injection surface. Analysis:
- Ingestion points: GitHub issue labels and PR template files.
- Boundary markers: Regex requirements for branches and commits.
- Capability inventory:
git,gh, andshellcheck. - Sanitization: Structural validation via regex and conventional commit patterns. The risk is minimized by the skill's focus on structural validation rather than executing logic from untrusted data.
Audit Metadata