pr-review-comment
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR diffs, comments, and reviews in SKILL.md Step 2, creating a surface where external content could influence review logic. 1. Ingestion points: SKILL.md fetches file diffs and existing threads via gh api calls. 2. Boundary markers: Step 6 requires explicit user approval of the full JSON payload before any posting occurs. 3. Capability inventory: The skill can post new reviews and replies via gh api in Step 7. 4. Sanitization: Structural validation in Step 4 restates and verifies claims but lacks explicit data escaping.
- [COMMAND_EXECUTION]: The workflow utilizes gh CLI commands with variable substitution for repository metadata and environment variables (e.g., GH_HOST) in SKILL.md Steps 2 and 7.
- [METADATA_POISONING]: Reference file voice-and-tone.md uses futuristic dates (July 2026) and claims of verification against future APIs, which constitutes deceptive metadata.
Audit Metadata