pr-overview
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Executes the GitHub CLI (
gh) to retrieve pull request metadata, diffs, and comments.- [COMMAND_EXECUTION]: Invokes a local Python script (~/.claude/scripts/build_review_html.py) to process data and generate the final HTML overview.- [COMMAND_EXECUTION]: Checks for and optionally executes a local binary (pulsar) to publish or archive the generated report.- [PROMPT_INJECTION]: The skill processes untrusted external data from GitHub PR descriptions and user comments, which represents an indirect prompt injection surface. * Ingestion points: PR body and comments retrieved viagh pr viewand GraphQL API. * Boundary markers: No explicit boundary markers or 'ignore' instructions are used during processing. * Capability inventory: Executes shell commands (gh,python3,pulsar) and writes files to the local repository. * Sanitization: The instructions mandate passing the content 'verbatim' to the JSON payload, although the final rendering script is expected to perform HTML escaping.
Audit Metadata