gh-pr
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes powerful command-line tools including
gitfor commits and pushes, and the GitHub CLI (gh) for API mutations. It also invokes "quality gates" defined within the local repository, which typically involves executing arbitrary shell scripts, test runners, or build tools. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and obeys instructions from GitHub PR review comments. A malicious reviewer could embed instructions in a comment to trick the agent into performing unauthorized code modifications or data exfiltration via the available git and network tools.
- Ingestion points: Untrusted data enters the context via
scripts/gh-review-comments, which fetches thebodycontent of PR review threads. - Boundary markers: Absent. The instructions do not define delimiters or provide specific prompts to ensure the agent ignores instructions embedded within the comment text.
- Capability inventory: The agent has capabilities for file system read/write, arbitrary shell execution (via quality gates), and authenticated network access through the GitHub API.
- Sanitization: Absent. PR comment content is interpolated into the workflow and planning phases without validation or escaping.
Audit Metadata