review-pr
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from GitHub Pull Request metadata and diffs via
gh pr viewandgh pr diff(SKILL.md). There are no boundary markers or sanitization steps mentioned. The agent has capabilities to execute shell commands (git, gh, rg) and write files, which could be exploited by malicious content within a PR. - [COMMAND_EXECUTION]: Shell Command Interpolation. The skill instructs the agent to build shell commands using PR numbers and title-derived keywords. This interpolation lacks explicit escaping, relying on the agent's platform to handle potentially malicious input.
- [SAFE]: Execution Isolation. The workflow uses
git worktreeto isolate the review process from the main project directory, preventing accidental modification of the local repository state. - [SAFE]: Operational Guardrails. The skill provides clear instructions to avoid destructive commands such as
git pushor stopping the gateway service, maintaining the read-only nature of the review.
Audit Metadata