implement-review-pr

Warn

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill explicitly suggests using the environment variable GIT_SSL_NO_VERIFY=1 when running in sandbox environments. This instruction disables SSL/TLS certificate verification for all Git and GitHub CLI operations. This bypasses critical security protections, making the connection vulnerable to Man-in-the-Middle (MitM) attacks where an attacker could intercept or inject malicious content into the PR data being reviewed.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted content from GitHub Pull Requests and uses that content to influence its logic and subsequent actions.
  • Ingestion points: PR titles, descriptions, and diffs are ingested via gh pr view and gh pr diff in SKILL.md (Step 1).
  • Boundary markers: Absent. There are no instructions to use delimiters or ignore instructions embedded within the PR content.
  • Capability inventory: The skill has the capability to write back to the external source using gh pr review in SKILL.md (Step 7).
  • Sanitization: Absent. The skill does not perform any validation or escaping of the ingested data before processing it.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 16, 2026, 07:51 AM
Security Audit — agent-trust-hub — implement-review-pr