make-pr-easy-to-review
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Pull Requests which could contain malicious instructions.
- Ingestion points: Processes PR URLs, branch names, commit messages, and diff data via git and gh commands as defined in the SKILL.md workflow.
- Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the ingested PR content.
- Capability inventory: The skill executes shell commands using git and gh, including functionality to rewrite commit history and force-push changes.
- Sanitization: There is no evidence of sanitization, escaping, or validation of the ingested external content before it is used by the agent to plan and execute history rewrites.
- [COMMAND_EXECUTION]: The skill relies on shell command execution via git and gh to perform its core functions. Although it incorporates a safety check by comparing the tree hash (git rev-parse) to ensure code behavior remains unchanged, the capability to modify repository history and force-push to remote branches represents a significant operational risk if the agent's instructions are influenced by malicious input.
Audit Metadata