datahub-connector-pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data from GitHub pull requests (diffs and comments), which is a significant attack surface for indirect prompt injection. \n
- Ingestion points: Untrusted data enters the agent context through tools like
gh pr viewandgh pr diff, and PR comments, as defined inSKILL.mdandreferences/manual-review-guide.md. \n - Boundary markers: The skill implements explicit boundary markers, instructing the agent to wrap untrusted content in
<untrusted-pr-content>tags to prevent the AI from following instructions embedded in the code. \n - Capability inventory: The agent has access to powerful tools including
Bash,git, andgh, and executes local Python and Bash scripts (extract_aspects.py,gather-connector-context.sh). \n - Sanitization: The skill performs sanitization by validating PR numbers against a numeric regex (
^\\d+$) and connector names against an alphanumeric allowlist (^[a-zA-Z0-9_-]+$) before shell execution. It also mandates the inclusion of a trust disclaimer in all sub-agent prompts to prevent instruction leakage.
Audit Metadata