review-pr
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to discover and execute project-specific scripts (e.g., tests, build, lint) directly from the PR head. This is a risk as a malicious PR could contain harmful code in these scripts that executes during the verification step.
- Evidence:
Discover the project's package manager and scripts before choosing commands.,Run targeted tests first... - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes Pull Request metadata (title, body, comments) and code diffs without explicit boundary markers or sanitization. An attacker could embed instructions in a PR to bypass review gates or force a merge.
- Ingestion points:
gh pr view,gh pr diff, and checking out the PR branch. - Boundary markers: None identified; no instructions to ignore embedded commands or treat PR content as data.
- Capability inventory: Shell command execution (git, gh, npm/pip), merge capabilities, and browser-based smoke testing.
- Sanitization: None identified.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch external data from GitHub and interacts with remote PR preview environments.
- Evidence:
git fetch origin pull/<number>/head:refs/remotes/pr/<number>,gh pr view <number>, and accessing preview URLs.
Audit Metadata