reviewing-prs
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from external sources (GitHub Pull Requests) that could contain instructions designed to bypass agent constraints or influence the review outcome.
- Ingestion points: The skill reads external data via
gh pr view,gh pr diff, and the GitHub API for comments inSKILL.md. - Boundary markers: The instructions lack explicit boundary markers or delimiters (e.g., XML tags or clear separators) to isolate the untrusted PR content from the agent's core instructions.
- Capability inventory: The skill has the capability to modify state on GitHub using write commands like
gh pr reviewandgh pr comment. - Sanitization: The skill implements a strong manual approval requirement, instructing the agent to never post reviews without explicit prior user confirmation, which serves as a primary mitigation against automated exploitation.
Audit Metadata