address-pr-comments
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it fetches and processes pull request comments from external sources (human reviewers and automated bots). An attacker with access to the PR could craft a comment containing malicious instructions that the agent might inadvertently follow while creating its 'Proposed fix' or executing the plan.
- Ingestion points: Pull request comments fetched from GitHub APIs (referenced in Phase 1 and Phase 2).
- Boundary markers: The instructions do not define any specific delimiters or 'ignore embedded instructions' warnings for the fetched comment data.
- Capability inventory: The agent has the capability to read and modify local files (Phase 4), run shell commands such as linters/formatters (Phase 4, e.g., 'flutter analyze', 'dart format'), and interact with GitHub APIs to post replies and resolve threads (Phase 6).
- Sanitization: There is no evidence of sanitization or escaping of the comment content before it is processed by the agent to generate code changes or plans.
- [COMMAND_EXECUTION]: The skill instructs the agent to run project-specific shell commands for linting and formatting (e.g., 'flutter analyze', 'dart format') after making changes. While these are standard developer tools, they represent a capability that could be targeted if an indirect prompt injection attack succeeds in manipulating the file content or the context of the execution.
Audit Metadata