pr-review-fixer
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing external data from GitHub.
- Ingestion points: Fetches review thread comments, review bodies, and issue comments using
gh api graphqlinSKILL.md. - Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to disregard instructions potentially embedded within the PR comments.
- Capability inventory: The skill uses
Bashfor command execution (GitHub CLI and local build tools) andWrite/Editfor modifying the repository's source code. - Sanitization: Absent. The skill interprets the PR comment text directly to create a "Review Overview" and subsequent "Task List" for execution.
- [DYNAMIC_EXECUTION]: The skill identifies and executes arbitrary test and lint commands found within the project environment (e.g.,
make test,pytest,go test). While standard for development workflows, this execution is triggered dynamically based on the local environment and the agent's interpretation of PR feedback, which could be abused if the agent is misled by malicious input.
Audit Metadata