arc-pr-review-loop
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external PRs to drive its logic.
- Ingestion points: The skill fetches PR titles, bodies, code diffs, and issue comments using
gh pr viewandgh pr diff(Step 1). - Boundary markers: There are no explicit instructions to the agent to treat PR content as untrusted or to ignore instructions embedded within the diffs or comments.
- Capability inventory: The skill possesses the ability to post PR comments, trigger code-writing agents, and merge PRs (Step 3, 4, and 6).
- Sanitization: No sanitization or validation of the fetched PR metadata or code content is mentioned before it is processed by the LLM.
- [COMMAND_EXECUTION]: The skill utilizes the
gh(GitHub) CLI tool to retrieve information and perform review actions. It also coordinates with implementation agents that modify the local repository worktree and execute Git commands.
Audit Metadata