address-review-bots
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data from GitHub Pull Request comments. This creates a surface for indirect prompt injection, where malicious or misleading feedback could attempt to steer the agent's code modifications.- Ingestion points: External comments are fetched from the GitHub API using the bundled script 'scripts/review-bot-snapshot.mjs' (processed in 'SKILL.md' Step 3 and 4).- Boundary markers: The instructions include a 'Review Judgment' section directing the agent to treat feedback as 'input, not authority' and to verify all claims against the actual code and tests.- Capability inventory: The agent has the ability to modify the local filesystem, execute repository-defined validation scripts, and push changes back to the remote repository.- Sanitization: There is no explicit sanitization of the comment body text before the agent processes it for classification and fixing.- [COMMAND_EXECUTION]: The skill executes local development commands including 'git', 'gh' (GitHub CLI), and repository-specific scripts found in 'package.json' (such as 'lint', 'test', and 'precommit'). It also allows for a user-defined validation command via the 'REVIEW_BOT_VALIDATION_COMMAND' environment variable. These commands are used for standard development tasks like viewing PR status, committing changes, and verifying code integrity.
Audit Metadata