address-pr-reviews
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes PR review feedback, which constitutes an attack surface for indirect prompt injection.
- Ingestion points: Data is ingested via the
scripts/fetch-reviewsscript, which collects pull request reviews, comments, and threads from the GitHub API. - Boundary markers: A robust trust boundary is defined in
scripts/gate.jq, which distinguishes between 'inside' text (from organization members and trusted bots) and 'outside' text. Untrusted content is withheld from the agent's context and represented only as links for human review. - Capability inventory: The agent has the capability to modify repository files (scoped to the PR diff), post PR comments using the
ghCLI, and execute GraphQL mutations to resolve review threads. - Sanitization: The skill automatically sanitizes input by stripping Unicode tag characters (U+E0000–U+E007F) in
scripts/gate.jqto prevent steganographic or hidden instruction attacks. - [COMMAND_EXECUTION]: The skill executes local bash scripts (
scripts/fetch-reviews) and interacts with the GitHub CLI (gh) to perform its primary functions. These operations are scoped to the project environment and are necessary for the skill's intended purpose of managing PR feedback.
Audit Metadata