fix-pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull request comments and uses a subagent to triage them, which then proposes code changes and GitHub replies. This creates a surface for indirect prompt injection where a malicious PR comment could attempt to influence the agent's behavior.
- Ingestion points: Fetches PR review threads and comments via the GitHub GraphQL and REST APIs (documented in Phase 2 and
references/fetch-review-data.md). - Boundary markers: The triage subagent prompt in
references/triage-prompt.mduses structured markdown headers and sections to delimit comment data. - Capability inventory: The agent has the capability to edit files, execute repository-level shell commands (git, gh, turbo, bun), and post mutations to GitHub.
- Sanitization: The skill employs a plan validation step (Phase 4), a reply validator that checks for forbidden patterns (Phase 7), and requires explicit human confirmation before executing fixes or posting replies.
- [PERSISTENCE]: In Phase 8, the skill offers to save triage decisions to a
.claude/review-suppressions.ymlfile within the repository. This persists logic that governs how findings are triaged in future runs, though it requires explicit user selection for each item saved. - [COMMAND_EXECUTION]: The skill executes several common development CLI tools, including
git,gh,bun, andturbo, to perform PR management, code analysis, and type checking.
Audit Metadata