gh-pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external pull requests and uses it to drive agent actions, creating a significant attack surface.
- Ingestion points: Pull request descriptions, code diffs, and modified files (SKILL.md).
- Boundary markers: Absent. The instructions lack delimiters or explicit warnings to the agent to ignore instructions or malicious patterns embedded within the PR data.
- Capability inventory: The agent is granted access to the
Bashtool and is instructed to execute shell commands, run tests, and fetch external web content. - Sanitization: Absent. No validation or sanitization of the PR content is required before the agent interacts with or executes it.
- [REMOTE_CODE_EXECUTION]: The instruction to "Check out the branch and run the tests the PR touches" introduces a remote code execution risk. An attacker can submit a pull request containing malicious code in the tests or in the project's build/test configuration (e.g.,
package.jsonscripts,Makefile, or test hooks) that will be executed when the agent attempts to perform the review. - [DYNAMIC_EXECUTION]: The skill directs the agent to "write a throwaway test... run it, then delete it." This dynamic generation and execution of code is risky if the logic of the generated test is influenced by malicious patterns or deceptive code structures found within the pull request being analyzed.
Audit Metadata