git-pr-codex-loop
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute git and GitHub CLI (
gh) commands to manage the development lifecycle. - Evidence: Execution of
git push,gh pr create,gh pr checks --watch, and variousgh apiandgh api graphqlcommands inSKILL.md. - [PROMPT_INJECTION]: The skill implements a workflow that reads and interprets untrusted external data (GitHub comments) which could influence the agent's behavior through indirect prompt injection (Category 8).
- Ingestion points: Reads review comments using
gh pr view --commentsand fetches GraphQLreviewThreadsinSKILL.md. - Boundary markers: Absent; there are no explicit delimiters or instructions to the agent to disregard instructions embedded within the fetched comments.
- Capability inventory: The agent has the ability to modify local files, execute shell commands via the Bash tool, and push code back to the repository.
- Sanitization: Absent; the content of the comments is processed directly to determine fixes without validation or sanitization of the natural language input.
Audit Metadata