codex-pr-body
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection: The skill retrieves existing pull request descriptions and uses conversation history to generate updates. This introduces a surface where external or untrusted text could influence the agent's output. The skill includes instructions to filter specific types of sensitive information, such as local paths and confidential codenames, which serves as a mitigation.
- Ingestion points: Pull request bodies retrieved via
gh pr viewand the current conversation context. - Boundary markers: None explicitly defined for untrusted text.
- Capability inventory: GitHub CLI (
gh), Git, and Sapling (sl) for repository management. - Sanitization: Instructions provided to avoid local paths and confidential information, though formal sanitization of external input is not specified.
- Command Execution: The skill utilizes standard version control and GitHub CLI tools (
git,gh,sl) to perform its tasks. These operations are restricted to the intended repository context and are necessary for the skill's primary functionality.
Audit Metadata