address-comments
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, specifically pull request comments, review threads, and review summaries from GitHub (SKILL.md Step 3).
- Ingestion points: Untrusted data enters the agent context via
gh api graphqlandgh api repos/<owner>/<repo>/issues/<number>/commentswhich fetch user-generated text from the PR environment. - Boundary markers: The skill does not explicitly define delimiters for separating comment text from instructions; however, it retrieves data as structured JSON through the GitHub API.
- Capability inventory: The skill has significant capabilities, including modifying local source code, executing
git commitandgit push, filing tickets, and posting new comments/resolving threads via the GitHub API (SKILL.md Step 7). - Sanitization: The skill includes a critical safety mechanism in Step 6, which mandates a manual review and explicit user approval of the drafted plan before any files are modified or API actions (pushes, posts, resolutions) are executed. This human-in-the-loop requirement is the primary defense against an agent potentially being misled by instructions embedded within a malicious PR comment.
Audit Metadata