resolve-pr-comments
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the 'gh' (GitHub CLI) tool to perform various operations, including 'gh pr view' to gather pull request data, 'gh api' to fetch comments, and 'gh api' to post replies. It also utilizes the shell 'sleep' command to introduce delays between network requests.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and acts upon untrusted data provided in PR comments.
- Ingestion points: Untrusted comment text is ingested from the GitHub API using 'gh api repos/{owner}/{repo}/pulls/{number}/comments' and 'gh pr view', as defined in the SKILL.md process.
- Boundary markers: There are no boundary markers or specific instructions (e.g., delimiters) used to isolate the PR comment content from the agent's internal instructions.
- Capability inventory: The skill has significant capabilities, including the ability to modify the local codebase ("fix the code") and execute shell commands to interact with external APIs.
- Sanitization: No sanitization or validation logic is defined to inspect or filter the content of PR comments before they are used to drive code changes.
Audit Metadata