implement-review-pr
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The skill reads external content via
gh pr view,gh pr diff, andgh issue listfrom the relative fileSKILL.md. - Boundary markers: The instructions lack clear delimiters or instructions for the LLM to ignore embedded commands within the ingested PR and issue data.
- Capability inventory: The skill has the ability to write to the repository using
gh pr review,gh issue comment, andgh issue createas documented inSKILL.md. - Sanitization: The skill includes a specific security note to use HEREDOC (
<<'EOF') and variable quoting ("${var}") to prevent shell-level command injection, which is a significant mitigation for command execution but does not prevent prompt-level injection. - [COMMAND_EXECUTION]: The skill relies on the
gh(GitHub CLI) to perform its operations. While these are necessary for the skill's functionality, they involve executing shell commands with arguments derived from external data (PR numbers, issue numbers, and generated report bodies).
Audit Metadata