dev7-pr
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It retrieves pull request comments using
gh pr viewand the GitHub API, then instructs the agent to "Read each comment" and "Apply the fix to the relevant file". Since PR comments are external, untrusted inputs, an attacker could embed malicious instructions in a comment to manipulate the agent's behavior or code modifications. - Ingestion points: External data is ingested through
gh pr view --commentsand the GitHub API pulls comments endpoint inSKILL.md. - Boundary markers: None identified; the agent is instructed to directly apply fixes based on the content of the comments.
- Capability inventory: The skill has capabilities for file system modification, git commits/pushes, and GitHub CLI operations.
- Sanitization: There is no evidence of input validation, instruction filtering, or escaping for the retrieved external content before it is processed by the agent.
Audit Metadata