datahub-connector-pr-review

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data from GitHub pull requests (diffs and comments), which is a significant attack surface for indirect prompt injection. \n
  • Ingestion points: Untrusted data enters the agent context through tools like gh pr view and gh pr diff, and PR comments, as defined in SKILL.md and references/manual-review-guide.md. \n
  • Boundary markers: The skill implements explicit boundary markers, instructing the agent to wrap untrusted content in <untrusted-pr-content> tags to prevent the AI from following instructions embedded in the code. \n
  • Capability inventory: The agent has access to powerful tools including Bash, git, and gh, and executes local Python and Bash scripts (extract_aspects.py, gather-connector-context.sh). \n
  • Sanitization: The skill performs sanitization by validating PR numbers against a numeric regex (^\\d+$) and connector names against an alphanumeric allowlist (^[a-zA-Z0-9_-]+$) before shell execution. It also mandates the inclusion of a trust disclaimer in all sub-agent prompts to prevent instruction leakage.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:44 AM
Security Audit — agent-trust-hub — datahub-connector-pr-review