github-review-pr
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub pull requests, including code, comments, and review history, which creates a surface area for indirect prompt injection. Ingestion points include PR metadata and content fetched via the GitHub API and CLI. Boundary markers are present as specific instructions to treat PR-controlled content as untrusted and to load critical instructions (like AGENTS.md) from the base branch. Capability inventory includes repository modification, merging, and test execution. Sanitization is handled through agent technical review and mandatory user authorization for all external mutations.
- [COMMAND_EXECUTION]: The skill relies on numerous git and GitHub CLI commands to fetch objects, compute three-way merges, and manage pull request workflows. Evidence includes commands like
gh pr view,git fetch,git merge-tree, andgh pr mergeused throughout the workflow. - [DYNAMIC_EXECUTION]: The skill executes tests defined within the repository being reviewed to validate contributions. The instructions explicitly mandate running these untrusted tests in isolated temporary clones or sandboxes with credentials removed to prevent unauthorized data exposure.
- [EXTERNAL_DOWNLOADS]: The skill retrieves Git objects and metadata from GitHub repositories. These operations target a well-known service and are fundamental to the skill's stated purpose of reviewing external contributions.
Audit Metadata