github-code-review

Pass

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from external Pull Requests.
  • Ingestion points: The agent ingests untrusted code and metadata using git diff, gh pr diff, and the GitHub API (processing PR titles and bodies via curl).
  • Boundary markers: No delimiters or specific instructions are present to isolate the reviewed code from the agent's control logic or to prevent the agent from following instructions embedded in the code.
  • Capability inventory: The skill uses curl, gh, and git to interact with external platforms, allowing it to post review comments and modify PR states based on the ingested content.
  • Sanitization: The instructions do not define any sanitization or validation logic for data retrieved from external repositories.
  • [EXTERNAL_DOWNLOADS]: Fetches Pull Request data and metadata from the official GitHub API (api.github.com). These network operations are performed to a well-known service for the skill's primary purpose.
  • [DATA_EXFILTRATION]: The skill accesses local sensitive files, including ~/.git-credentials and ~/.hermes/.env, to retrieve GitHub authentication tokens. This behavior is documented as a standard method for the tool to authenticate its API requests to GitHub and does not involve sending data to untrusted domains.
Audit Metadata
Risk Level
SAFE
Analyzed
May 19, 2026, 07:46 PM
Security Audit — agent-trust-hub — github-code-review