pr-review-loop
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources (GitHub PR comments, review statuses, and CI checks).
- Ingestion points: According to Step 1 in
SKILL.md, the skill reads the "latest comments, review results, and check status" from the Pull Request. - Boundary markers: The skill uses a specific HTML comment
<!-- pr-review-loop:reply -->to distinguish its own replies, but it lacks explicit delimiters or instructions to ignore potential commands embedded in the comments it processes. - Capability inventory: The skill can execute shell commands via the GitHub CLI (
gh api,gh pr edit) and uses a$code-review-panelfor automated auditing. - Sanitization: No explicit sanitization, validation, or escaping of the incoming comment text is described before the agent categorizes the input into actionable buckets (e.g., "Act on", "Consider").
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell command substitution for posting replies to GitHub.
- Evidence: The instructions for posting replies in
SKILL.mdutilize the pattern-f body="$(cat '<回复文件>'; ...)", which executes a subshell to read a local file's content into the command line arguments.
Audit Metadata