walk-pr

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The generated canvas artifact references external JavaScript and CSS libraries (diff2html and highlight.js) from the cdn.jsdelivr.net content delivery network, which is a well-known service.
  • [COMMAND_EXECUTION]: To support its visualization features, the skill uses platform-specific browser launchers (open, xdg-open, or start) to open generated HTML artifacts from the host's temporary directory.
  • [PROMPT_INJECTION]: The skill processes untrusted data from Pull Request URLs and diff ranges, creating a potential surface for indirect prompt injection.
  • Ingestion points: PR metadata and code diffs provided via URL or range (SKILL.md).
  • Boundary markers: The skill does not define specific delimiters or instructions for the agent to treat diff content as non-instructional data.
  • Capability inventory: The skill possesses the ability to write files to the local temporary directory, execute browser-launching commands, and interact with the GitHub API (SKILL.md, references/CANVAS_MODE.md).
  • Sanitization: There is no explicit description of sanitization or escaping logic for the PR data before it is embedded into the HTML canvas artifact.
  • [REMOTE_CODE_EXECUTION]: In canvas mode, the skill performs dynamic code generation by populating an HTML/JavaScript template with PR data and executing it within a local browser environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 09:47 PM
Security Audit — agent-trust-hub — walk-pr