code-review
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes untrusted data from pull request diffs, metadata, and repository guidance files while maintaining write capabilities.
- Ingestion points: Untrusted data enters the agent context through
gh pr view,gh pr diff, and repository-specific files such asAGENTS.md,CLAUDE.md, and contribution documentation. - Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions within the reviewed code changes.
- Capability inventory: The skill uses
gh pr commentto post feedback, which could be exploited to perform actions on behalf of the agent if it obeys instructions embedded in the diff. - Sanitization: No sanitization, escaping, or validation of the ingested content is described in the skill logic.
- [COMMAND_EXECUTION]: The skill executes local CLI tools to perform its core functions.
- Evidence: The skill uses
git(for local diffs and history) andgh(for GitHub pull request metadata and commenting).
Audit Metadata