pr-review
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to ingest and process untrusted data from GitHub pull requests, which could be manipulated to influence agent behavior.
- Ingestion points: The skill retrieves PR metadata, unified diffs, review comments, and commit messages from the GitHub API in Step 4.
- Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from obeying instructions that might be embedded within the pull request description or code comments.
- Capability inventory: The agent has the ability to merge pull requests, modify issue/PR labels, and post comments to GitHub, which are high-privilege operations.
- Sanitization: The instructions do not specify methods for sanitizing or escaping the content of the pull request before it is analyzed or used to generate the summary documents in Step 7.
- [PROMPT_INJECTION]: Automated Action Risk. The skill includes a feature in Step 8f that reads back generated review documents to batch-post comments. If the original review document was influenced by malicious input from a pull request diff or description, this could lead to the agent proposing or performing unintended actions, though the skill does include a confirmation step.
Audit Metadata