panel-review
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches pull request metadata, diffs, and comments from GitHub using the
ghCLI andgit. These sources are well-known and expected for the skill's functionality. - [COMMAND_EXECUTION]: Orchestrates local CLI agents and executes shell commands (such as grep, build, and test scripts) within isolated git worktrees. This 'deep review' mode is a documented feature and includes warnings about the security trade-offs of executing untrusted code.
- [PROMPT_INJECTION]: Indirect prompt injection surface identified. Untrusted data enters the agent context from pull request titles, bodies, and comments via 'gh pr view' and 'gh api' calls. Boundary markers such as '## PR description' and '## Diff' are used to delimit content. The sub-agents possess extensive capabilities, including executing shell commands, grep, and test suites within isolated worktrees. No sanitization or escaping is performed on the ingested PR content before its interpolation into agent prompts.
- [COMMAND_EXECUTION]: The script uses string replacement to insert PR identifiers into prompt templates for sub-agents. While this creates a potential command injection path if a sub-agent blindly executes the substituted strings, the risk is mitigated by the fact that the sub-agents are instructions-following AI models and the inputs are typically controlled by the coordinator agent.
Audit Metadata