address-pr-comments
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) due to the ingestion of untrusted external data.
- Ingestion points: The workflow fetches PR metadata and review comments (Step 1), which are external inputs that can be controlled by third-party reviewers or malicious contributors.
- Boundary markers: The instructions lack boundary markers or warnings to the agent to disregard instructions or shell commands embedded within PR comments.
- Capability inventory: The skill allows for file system writes ("Implement the agreed fixes" in Step 4) and shell command execution ("Run the smallest relevant validation" in Step 5).
- Sanitization: No sanitization, filtering, or validation steps are described for the PR comment content before the agent acts on it.
Audit Metadata