PR Review
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several bash scripts in the
scripts/directory (determine_review_type.sh,get_pr_comments.sh,post_inline_comment.sh,reply_pr_comment.sh,submit_pr_review.sh) that wrap thegh(GitHub) CLI to perform repository actions. These scripts are used for legitimate PR management tasks such as fetching metadata, staging comments, and submitting batched reviews. The use ofset -euo pipefailand proper variable quoting indicates standard scripting practices. - [SAFE]: The skill follows security best practices by explicitly instructing the agent to never run tests locally during the review process, which prevents potential execution of untrusted code from a pull request. It also mandates obtaining explicit user approval before posting any comments to GitHub, ensuring human-in-the-loop oversight for all remote interactions.
Audit Metadata