review
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR descriptions, comments, and file contents which could contain malicious instructions. Ingestion points: Fetches metadata, diffs, and existing comments via gh CLI and GitHub API. Boundary markers: No explicit delimiters or ignore instructions are specified for separating untrusted PR data from the agent context. Capability inventory: The skill can execute shell commands (git, gh), discovery scripts, and write to the GitHub API. Sanitization: The instructions mandate a 'Reconciliation & confirmation gate' where the user must explicitly approve any review before posting, providing a strong mitigation.
- [COMMAND_EXECUTION]: The skill executes multiple shell commands using git and gh CLIs. Evidence: REFERENCE.md contains bash scripts that manage worktrees, clone repositories, and use a loop 'for d in ~/Repos/* ~/repos/* ~/dev/*' to search for local git clones. Risk: The filesystem discovery loop reads directory names in common development folders within the user's home directory. Furthermore, shell commands use variables extracted from user-provided PR references (owner, repo, branch) without explicit sanitization logic in the instructions.
Audit Metadata