prc
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes external, untrusted content from pull request comments and review summaries using the GitHub CLI (
gh api). This data is then used to guide the agent's code modification actions and shell command construction. - Ingestion points: Untrusted comment text and review bodies are ingested via
gh apiinSKILL.md(Step 2). - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the fetched content purely as data or to ignore any embedded instructions.
- Capability inventory: The skill has broad capabilities including reading repository files, applying code fixes (writing files), and executing shell commands (
git,gh). - Sanitization: No sanitization or escaping is performed on the comment text before it is processed by the model or used as a search pattern in
git log --grep(Step 3), which creates a surface for command or prompt injection if the agent fails to handle the input as a literal string.
Audit Metadata