pr-review

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub Pull Request titles, bodies, diffs, and comments, which could potentially contain instructions intended to influence the agent's behavior.
  • Ingestion points: The process involves loading the PR body, commits, diff, and all review threads (SKILL.md).
  • Capability inventory: The skill possesses the capability to write back to the external environment by posting PR comments and submitting review status (approvals or change requests) via the gh CLI (doctrine.md, reference.md).
  • Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" tags when processing the ingested PR content, though they refer to a shared review contract for governing findings.
  • Sanitization: While the instructions demand factual assessment and adherence to specific architectural doctrines, there is no explicit mention of technical sanitization of the input data before it is processed by the model.
  • Mitigation: A strong human-review checkpoint is implemented; the skill is required to show all drafts in chat and receive explicit approval before posting any comments or submitting the review (reference.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 08:19 PM
Security Audit — agent-trust-hub — pr-review