factory-review-prs
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from pull requests to determine whether to approve or merge code. This creates a surface for indirect prompt injection attacks where malicious content within a PR (such as code comments or diffs) could attempt to influence the agent's decision-making process.
- Ingestion points: The skill reads PR state, diffs, linked issues, review threads, and author eligibility (SKILL.md).
- Boundary markers: No explicit instruction delimiters are defined to separate untrusted PR data from the agent's core instructions.
- Capability inventory: The skill can perform PR writes, approvals, and merges (SKILL.md).
- Sanitization: No specific sanitization or filtering of external PR content is described.
- [SAFE]: The skill references configuration documentation from the vendor's official GitHub repository (BuilderIO/skills). This is an expected reference for the skill's functionality.
Audit Metadata