raise-pr
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard shell commands (
git,gh,lsof,kill,grep) to manage the development lifecycle, including terminating background processes on specific ports and performing self-reviews of code changes. - [CREDENTIALS_UNSAFE]: The skill uses environment variables (
AGENT_PR_TOKENandSHOPIFY_GH_ACCESS_TOKEN) for GitHub authentication. It explicitly instructs the agent to verify the existence of these tokens without echoing their values, which is a defensive measure against credential leakage in logs. - [METADATA_POISONING]: The instructions mandate the suppression of any mention of AI or automated tools in commit messages and PR descriptions. While this is a deceptive practice concerning the provenance of the code, it is presented as adherence to project-specific stylistic conventions.
Audit Metadata