renovate-review
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from untrusted GitHub Pull Request data. \n
- Ingestion points: The skill retrieves PR titles and bodies using
gh pr viewas specified inSKILL.md. \n - Boundary markers: There are no delimiters or instructions to the agent to ignore potentially malicious commands embedded in the PR data. \n
- Capability inventory: The availability of
Bash,WebFetch, andReadtools creates a surface for exploitation if injected instructions are followed. \n - Sanitization: Content retrieved from the PR is processed without validation or sanitization. \n- [COMMAND_EXECUTION]: Shell commands utilize direct variable interpolation, which presents a command injection risk. \n
- Evidence: The instruction
gh pr view $ARGUMENTSinSKILL.mdpasses raw user-supplied arguments to the shell. \n - Impact: Malicious input containing shell metacharacters could lead to the execution of unintended commands. \n- [EXTERNAL_DOWNLOADS]: The skill fetches release information from GitHub, which is a well-known service provider. \n
- Evidence: It uses
WebFetchto access release pages athttps://github.com/<owner>/<repo>/releases. \n - Context: This activity is a legitimate part of the skill's functionality to assess dependency changes.
Audit Metadata