bmad-os-review-pr
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests PR diffs from external sources and provides this content directly to LLM sub-agents as context for review.
- Ingestion points: Source code changes are fetched using
gh pr diffand passed to the 'Cynical Review' and 'Edge Case Hunter' sub-agents (Steps 1.1 and 1.2). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to separate the untrusted PR code from the sub-agent instructions.
- Capability inventory: The skill has the ability to execute shell commands (
git,gh), write files to the local file system, and post comments back to GitHub repositories. - Sanitization: The skill excludes binary files but does not perform sanitization or escaping of the text-based code content before processing.
Audit Metadata