check-pr
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to generate specific shell commands, such as
bash sleep <N>; reinvoke, which the calling environment is expected to execute verbatim. This design pattern delegates command construction to the agent, creating a risk if input sanitization is bypassed. \n- [PROMPT_INJECTION]: The skill accepts aSteeringinput which is plain-English and used to override behavior, including values used in thebashshell directive. This creates a potential vector for command injection where malicious steering input could attempt to hijack the directive output. \n- [PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR descriptions and review threads, creating a surface for indirect prompt injection. \n - Ingestion points: PR description and thread content accessed via GitHub PR URL (SKILL.md). \n
- Boundary markers: The skill includes explicit 'Hard prohibitions' that forbid the agent from carrying instructions or executable content from reviewer comments into commands or configuration. \n
- Capability inventory: The skill identifies targets for
retrigger,reply, andsleepdirectives which are executed by the calling environment. \n - Sanitization: The skill relies on agent judgment and fixed vocabulary but does not specify technical sanitization for content extracted from PR metadata.
Audit Metadata