review-loop
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with the Git version control system, the GitHub CLI for PR metadata, and the local Python interpreter for JSON data processing.
- [DATA_EXFILTRATION]: Transmits repository identifiers, branch names, and pull request body content to the vendor-owned domain
command-center.aigora.aito facilitate the review process. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted text from PR bodies and local documentation files, which are then used to build the instructions sent to the remote orchestrator.
- Ingestion points: Fetches external data using
gh pr view --json bodyand reads arbitrary files fromdocs/plans/or.ai-docs/plans/based on branch names. - Boundary markers: No explicit delimiters or safety instructions are used to isolate untrusted data within the prompt payload.
- Capability inventory: The agent has permissions to modify local files, commit changes, and push to remote repositories, providing a significant impact surface if the remote instructions are manipulated.
- Sanitization: The skill lacks validation or sanitization mechanisms for the ingested text before it is transmitted and processed.
Audit Metadata