make-pr-easy-to-review
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from pull request titles, commit messages, and PR descriptions via the GitHub CLI.
- Ingestion points: External data enters the agent context through the
gh pr viewcommand inSKILL.md. - Boundary markers: Absent. The skill lacks instructions to wrap untrusted content in delimiters or specific warnings to ignore instructions embedded within the PR metadata.
- Capability inventory: The skill has significant capabilities, including shell command execution (
git,gh) and history manipulation (git fetch, history rewriting). - Sanitization: There is no evidence of sanitization or validation of the ingested PR data before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill relies on shell commands for its core functionality. It interpolates variables such as
<PR>,<headRefName>, and<baseRefName>directly into command strings. If these identifiers are sourced from untrusted user input or malicious PR metadata without proper shell escaping or sanitization, they could serve as vectors for command injection.
Audit Metadata