review-that-runs
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands including
gh pr view,gh pr diff, andgit worktree add. It also invokes project-specific toolchains (e.g., nvm, npm/yarn) and "gates" such as linters and test suites defined within the repository being reviewed. - [DYNAMIC_EXECUTION]: The skill is designed to execute code found within the PR branch. This includes running build tools, serving frontends, and executing tests. This constitutes the execution of code that is not part of the skill's own source and may be controlled by the PR author.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from pull request diffs, descriptions, and project-specific documentation (e.g.,
CLAUDE.md,AGENTS.md). - Ingestion points: Data enters the context via
ghcommands and by reading files from the checked-out PR branch (SKILL.md, Flow section, steps 1, 2, 3, and 6). - Boundary markers: The skill does not define specific delimiters or warnings to prevent the agent from following instructions embedded within the PR content.
- Capability inventory: The agent has the ability to execute shell commands, manage files, and control a browser via the Chrome DevTools MCP.
- Sanitization: No sanitization or escaping of the PR content is performed before it is analyzed by the agent.
Audit Metadata