pr-review
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled shell script
scripts/run-pr-review.shto coordinate the review process. The script invokes local system utilities includinggitfor repository inspection andpython3for progress parsing, as well as the platform-specificcodexcommand for agent execution.\n- [DATA_EXFILTRATION]: To provide context for the review, the script reads git diffs and specific documentation files (such asAGENTS.mdandCODEX.md) from the target repository. This content is passed to the LLM-based review agents. The script includes checks to avoid following symbolic links when reading documentation files, reducing the risk of unauthorized file access.\n- [PROMPT_INJECTION]: The review agents are exposed to indirect prompt injection via the content of the PR diffs and repository guidance files.\n - Ingestion points: Repository files and git diff outputs.\n
- Boundary markers: The system uses specific headers to delimit the review packet and provides explicit instructions to agents to ignore external tools.\n
- Capability inventory: The workflow involves multiple sub-agent executions using
codex exec.\n - Sanitization: Diff content and documentation text are interpolated into prompts without specific filtering.\n- [DYNAMIC_EXECUTION]: The skill dynamically constructs prompts for specialist agents based on the repository content and handles execution output through an inline Python script. This execution is confined to the local environment and the intended review tasks.
Audit Metadata