github-review-pr
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub Pull Requests, including diffs, comments, and descriptions, which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: PR metadata, diffs, and comments are ingested through gh pr view, gh pr diff, and various GitHub API endpoints as defined in SKILL.md and subagent templates.
- Boundary markers: The skill implements a specific UNTRUSTED_CONTENT block injected into all reviewer subagent prompts, which explicitly instructs the model to treat PR content as data for analysis and not as instructions to be followed.
- Capability inventory: The skill has read and write capabilities on GitHub via the gh CLI, including the ability to post review comments and approve pull requests if authorized by the user.
- Sanitization: The workflow includes a dedicated Adversarial Verification step (Step 4) where a skeptic subagent independently re-reads the code to confirm or disprove findings, preventing the reporting of fabricated issues or hallucinations triggered by untrusted input.
- [COMMAND_EXECUTION]: The skill relies on the GitHub CLI (gh) for all repository interactions, executing commands such as gh pr list, gh pr diff, and gh api to fetch and manipulate pull request data. These executions are necessary for the skill's stated purpose of conducting automated code reviews.
Audit Metadata