gh-review-specific-pr
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to attempt to 'retry with escalated permissions' or use 'escalation' if GitHub API calls fail due to network restrictions or sandbox limitations. This encourages the agent to attempt to bypass environment security controls.
- Evidence: SKILL.md (Step 9) and reference/gh-api.md (final paragraph).
- [COMMAND_EXECUTION]: The skill heavily relies on executing the
ghCLI and constructing shell commands to interact with the GitHub API, including GraphQL queries and REST calls. - Evidence: SKILL.md (Workflow section) and reference/gh-api.md.
- [DYNAMIC_EXECUTION]: The agent is instructed to generate and use shell helper functions at runtime to batch multiple API responses and handle retries.
- Evidence: SKILL.md (Step 7).
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch PR diffs, surrounding code, and existing review threads from GitHub's API (github.com).
- Evidence: SKILL.md and reference/gh-api.md.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted code from pull request diffs and files which could contain malicious instructions.
- Ingestion points: PR diffs and source files accessed via
gh pr viewand direct file reads (SKILL.md Step 2). - Boundary markers: The skill includes instructions to 'verify findings against the actual diff' and 'read enough surrounding code to understand the real runtime path'.
- Capability inventory: Shell command execution via
ghCLI, GraphQL mutations, and the creation of shell helpers. - Sanitization: No explicit sanitization or escaping of the code content being reviewed is mentioned.
- Evidence: SKILL.md (Step 2).
Audit Metadata