pr
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from PR/MR titles, descriptions, and diff contents which creates a vulnerability to indirect prompt injection. A malicious actor could craft PR metadata designed to manipulate the AI's review outcome or its automated remediation steps.
- Ingestion points: Untrusted data enters the context in
references/workflows/review.md(Steps 4 and 5) where PR diffs and metadata are fetched, and inreferences/workflows/address.md(Step 3) where review comments are retrieved. - Boundary markers: The skill uses standard markdown headers and delimiters to separate untrusted data in prompts, but lacks explicit "ignore embedded instructions" guards or robust escaping for the interpolated PR content.
- Capability inventory: The skill possesses significant capabilities, including automated file writes in
references/workflows/address.md(Step 6), execution of git and platform CLI commands (gh/glab) inmerge.mdandpublish.md, and the ability to trigger other skills likedocsinagents/docs-freshness-checker.md. - Sanitization: There is no evidence of input sanitization or validation for the PR-derived strings before they are processed by the LLM sub-agents.
Audit Metadata