firebase-tools-pr-review
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze and review pull request diffs, which are untrusted external inputs. An attacker could embed malicious instructions within a PR diff (e.g., in a code comment) designed to influence the agent's review output or trigger unintended behavior.
- Ingestion points: Pull request diffs from the
firebase/firebase-toolsrepository (as described in the skill's name and instructions). - Boundary markers: The skill does not provide specific instructions or delimiters to the agent to distinguish between the provided review guidelines and potentially conflicting instructions embedded within the code diff data.
- Capability inventory: The skill provides a structural template for the agent to generate a review payload and includes a shell command (
gh api) to submit this payload as a formal review on GitHub. - Sanitization: There are no instructions for the agent to sanitize, escape, or ignore natural language instructions found within the code diffs it is analyzing.
Audit Metadata