review-pr
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The
SKILL.mdfile uses the dynamic context syntax to fetch pull request metadata using the$ARGUMENTSvariable. The commandgh pr view "$ARGUMENTS" --json ...is susceptible to shell command injection if the user provides a string containing command substitution patterns (e.g.,$(command)). This allows for arbitrary code execution in the agent's environment as soon as the skill is loaded. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub, including pull request comments and reviews. This content is used to drive the behavior of a specialized 'review-triage' agent that manages code fixes and merging. A malicious actor could use specially crafted comments to manipulate the agent into performing unintended actions on the repository.
- Ingestion points: Comments and reviews fetched from the GitHub API in
scripts/review-loop.sh. - Boundary markers: Instructions in
references/review-loop.mdmandate a skeptical 'gatekeeper' persona and independent agent context to mitigate automated bot noise. - Capability inventory: The skill possesses extensive capabilities including file modification,
git commit,git push, andgh pr mergeacross multiple phases. - Sanitization: Use of
jqinscripts/review-loop.shfor JSON processing and newline removal from comment strings.
Recommendations
- AI detected serious security threats
Audit Metadata