pr-review-html
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub pull requests via
gh pr diff. This creates a surface for indirect prompt injection, as malicious instructions hidden within a PR diff could attempt to manipulate the agent's reasoning or the content of the generated HTML. - Ingestion points: The output of the
gh pr diff <pr>command, which contains untrusted code and comments from external contributors. - Boundary markers: The instructions do not define clear delimiters or "ignore" directives to separate the diff content from the agent's meta-instructions.
- Capability inventory: The agent has the capability to execute shell commands (
gh) and write files to the system's temporary directory. - Sanitization: There is no mention of sanitizing or escaping the diff content before it is processed or rendered into the HTML output.
- [COMMAND_EXECUTION]: The skill invokes the GitHub CLI (
gh) to retrieve pull request data. This involves shell command execution where the PR reference (URL or number) is provided as an argument.
Audit Metadata