pr-thread-resolver
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR comments which could contain malicious instructions designed to influence the agent's behavior during the fix and commit process.
- Ingestion points: Review threads and comment bodies are fetched using
gh api graphqlas described inSKILL.md(Step 2) and thereferences/gh-graphql.mdfile. - Boundary markers: The skill instructions do not specify any delimiters or safety warnings to distinguish between trusted system instructions and untrusted content from the PR comments.
- Capability inventory: The skill has significant capabilities including file system modification (
SKILL.mdStep 5), git commits (SKILL.mdStep 7), pushing code to remote repositories (SKILL.mdStep 8), and executing GitHub API mutations to resolve threads. - Sanitization: There is no evidence of sanitization or filtering of the ingested comment text; the agent is instructed to apply suggestions verbatim if they match the code hunk.
Audit Metadata