gh-pr-review-fix
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill inherently possesses an indirect prompt injection attack surface as it processes untrusted external data in the form of GitHub PR review comments.
- Ingestion points: Untrusted PR review thread data is ingested via
codex-dev --json pr review startinSKILL.md. - Boundary markers: There are no explicit boundaries defined for the natural language text of the reviews, though code updates are constrained to exact suggestion fences when matching hunks.
- Capability inventory: The agent can modify files, execute local repo-native validation commands, stage semantic units, create git commits, and push branches to remote repositories.
- Sanitization: Input text sanitization is handled downstream by
codex-dev, which provides structural JSON validation and enforces process-wording checks during commit validation.
Audit Metadata