gh-pr-review
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data as part of its core review function, creating an attack surface for indirect prompt injection.
- Ingestion points: The skill reads pull request bodies, conversation comments, and review threads using
gh apicalls inreferences/pr-review.mdandreferences/teams-review.md. - Boundary markers: The skill instructions include logical gates, such as the "Product Demand gate" in
SKILL.md, which requires the agent to verify behavior against authoritative project artifacts rather than PR descriptions alone. - Capability inventory: The agent has the authority to execute repository commands (
git), interface with GitHub (gh), and run project tooling (pnpm). Iffixis authorized, it can modify the local filesystem. - Sanitization: The skill relies on architectural rules and manual authority checks (
fix/submitmodifiers) to mitigate the risk of executing instructions embedded in reviewed data. - [EXTERNAL_DOWNLOADS]: The skill requires the installation and use of a third-party GitHub CLI extension,
EurFelux/gh-pr-review, which is not part of the standard environment or a designated trusted vendor (references/pr-review.md). - [EXTERNAL_DOWNLOADS]: The skill references and fetches external best practices and guidelines from well-known services, including documentation and assets from Vercel Labs, React, Tailwind CSS, and shadcn/ui (
references/cherry-review-guidance.md). - [COMMAND_EXECUTION]: The skill uses shell commands for repository management, including creating git worktrees, fetching remote branches, and executing linting/testing scripts via
pnpm(SKILL.md,references/pr-review.md).
Audit Metadata