pr-review-loop
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the hosting platform, such as pull request comments, review summaries, and check status messages, which could be used to inject instructions and manipulate the agent's behavior.\n
- Ingestion points: The skill reads PR comments, reviews, and check statuses in each round (described in SKILL.md).\n
- Boundary markers: It uses a specific HTML comment to mark its own responses, providing a way to distinguish agent-generated content from external input.\n
- Capability inventory: The skill can execute shell commands for testing (make test), write to a ledger file, and perform network operations via gh or fj APIs.\n
- Sanitization: No explicit validation or escaping of the ingested PR comments is described before they are processed by the agent logic.\n- [COMMAND_EXECUTION]: The skill is designed to execute commands found in the repository's own templates and configuration files, such as .github/PULL_REQUEST_TEMPLATE.md.\n
- Evidence: In SKILL.md, the agent is instructed to run the table in the template, which includes placeholders for repository-specific check commands like make test.\n
- Risk: If a repository's template is maliciously modified, the agent may execute arbitrary code during the review process.
Audit Metadata