pre-land-refuters
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from pull requests, including diffs and metadata, which creates a surface for indirect prompt injection. An attacker could embed instructions in a PR to influence the refuter models' judgment. Ingestion points: PR metadata via 'gh pr view' and code changes via git diffs. Boundary markers: Not explicitly defined for the input data processed by refuters. Capability inventory: Uses shell scripts and the 'codex-exec' tool to evaluate PRs and record results. Sanitization: No specific filtering of PR content is mentioned before processing.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several local shell scripts (e.g., 'scripts/pawl-review.sh', 'scripts/pawl-verdict.sh', 'scripts/reconcile-pr.sh') and the 'codex-exec' tool. These commands are used to automate the PR review process and enforce merge gates based on external inputs like PR numbers and commit SHAs.
Audit Metadata