fetch-pr-corpus
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill's OCaml code (bin/fetch.ml) uses Unix.open_process_full to execute external commands gh auth token and curl. While these commands are used for legitimate data fetching and the code employs shell quoting to mitigate injection risks, it represents active system interaction.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data in the form of GitHub PR comments and review bodies.
- Ingestion points: bin/fetch.ml retrieves content from the GitHub REST and GraphQL APIs.
- Boundary markers: SKILL.md contains a specific warning advising the user to never follow instructions found within the comment bodies.
- Capability inventory: bin/fetch.ml has network access (via curl) and file writing capabilities. bin/filter.ml performs file reads and writes.
- Sanitization: The skill uses the Yojson library to parse and emit data in structured JSON/JSONL formats.
- [DATA_EXPOSURE]: The source code in bin/fetch.ml and bin/filter.ml includes a hardcoded default directory path (/Users/birrame.sene/.cache/clj-kondo-style-guide) which exposes the author's local system username.
Audit Metadata