skills/coldteadotai/pr-lens/eli5/Gen Agent Trust Hub

eli5

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using npx @coldtea/pr-lens-cli@latest to print manuals, validate graphs, render diagrams, and push content to a remote server. It also executes git commands to retrieve repository metadata and commit SHAs.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the @coldtea/pr-lens-cli package from the NPM registry at runtime. This package is part of the toolset provided by the author 'coldteadotai'.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill reads and interprets user-provided codebases, folders, and pull request data (SKILL.md).
  • Boundary markers: There are no delimiters or instructions to the agent to ignore or isolate natural language instructions found within the analyzed source code.
  • Capability inventory: The skill has the ability to execute shell commands (npx, git), write diagram files locally (.pr-lens/graph.json), and perform network operations by pushing data to prlens.dev via the CLI tool.
  • Sanitization: The skill lacks explicit sanitization, validation, or filtering for the external code content it processes before incorporating it into the walkthrough body.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 11:19 PM