github-code-review
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from external Pull Requests.
- Ingestion points: The agent ingests untrusted code and metadata using
git diff,gh pr diff, and the GitHub API (processing PR titles and bodies viacurl). - Boundary markers: No delimiters or specific instructions are present to isolate the reviewed code from the agent's control logic or to prevent the agent from following instructions embedded in the code.
- Capability inventory: The skill uses
curl,gh, andgitto interact with external platforms, allowing it to post review comments and modify PR states based on the ingested content. - Sanitization: The instructions do not define any sanitization or validation logic for data retrieved from external repositories.
- [EXTERNAL_DOWNLOADS]: Fetches Pull Request data and metadata from the official GitHub API (
api.github.com). These network operations are performed to a well-known service for the skill's primary purpose. - [DATA_EXFILTRATION]: The skill accesses local sensitive files, including
~/.git-credentialsand~/.hermes/.env, to retrieve GitHub authentication tokens. This behavior is documented as a standard method for the tool to authenticate its API requests to GitHub and does not involve sending data to untrusted domains.
Audit Metadata