pr-review

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled shell script scripts/run-pr-review.sh to coordinate the review process. The script invokes local system utilities including git for repository inspection and python3 for progress parsing, as well as the platform-specific codex command for agent execution.\n- [DATA_EXFILTRATION]: To provide context for the review, the script reads git diffs and specific documentation files (such as AGENTS.md and CODEX.md) from the target repository. This content is passed to the LLM-based review agents. The script includes checks to avoid following symbolic links when reading documentation files, reducing the risk of unauthorized file access.\n- [PROMPT_INJECTION]: The review agents are exposed to indirect prompt injection via the content of the PR diffs and repository guidance files.\n
  • Ingestion points: Repository files and git diff outputs.\n
  • Boundary markers: The system uses specific headers to delimit the review packet and provides explicit instructions to agents to ignore external tools.\n
  • Capability inventory: The workflow involves multiple sub-agent executions using codex exec.\n
  • Sanitization: Diff content and documentation text are interpolated into prompts without specific filtering.\n- [DYNAMIC_EXECUTION]: The skill dynamically constructs prompts for specialist agents based on the repository content and handles execution output through an inline Python script. This execution is confined to the local environment and the intended review tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 08:09 PM
Security Audit — agent-trust-hub — pr-review