pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Request titles, bodies, diffs, and comments, which could potentially contain instructions intended to influence the agent's behavior.
- Ingestion points: The process involves loading the PR body, commits, diff, and all review threads (SKILL.md).
- Capability inventory: The skill possesses the capability to write back to the external environment by posting PR comments and submitting review status (approvals or change requests) via the
ghCLI (doctrine.md, reference.md). - Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" tags when processing the ingested PR content, though they refer to a shared review contract for governing findings.
- Sanitization: While the instructions demand factual assessment and adherence to specific architectural doctrines, there is no explicit mention of technical sanitization of the input data before it is processed by the model.
- Mitigation: A strong human-review checkpoint is implemented; the skill is required to show all drafts in chat and receive explicit approval before posting any comments or submitting the review (reference.md).
Audit Metadata