validate-pr
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the
ghCLI to interact with GitHub repositories. It executes commands likegh pr viewandgh pr diffto retrieve pull request data and source code changes.\n- [EXTERNAL_DOWNLOADS]: The skill fetches external content from the GitHub API, including pull request descriptions, review comments, and inline discussion threads.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from PR comments (found inrules/fetch-pr-data.mdandrules/fetch-complete-coverage.md). It includes a mandatory validation step where every comment is cross-referenced against the actual code diff (found inrules/validate-against-diff.md), which serves to mitigate the risk of the agent following hallucinated or malicious instructions embedded in the comments. The available capabilities are limited to GitHub CLI operations (found inrules/setup-gh-cli.md).
Audit Metadata