pr-address-feedback
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from PR reviewers, which could contain instructions designed to influence the agent's behavior during the review process.
- Ingestion points: The skill fetches review threads, review bodies, and PR conversation comments using the GitHub CLI (
gh api) and GraphQL queries (SKILL.md, Section 1). - Boundary markers: Comments are isolated within a structured Markdown template and presented to the user using block quotes and '---' delimiters to separate them from the agent's instructions (SKILL.md, Section 2).
- Capability inventory: The agent has capabilities to edit files, commit, push changes, and post GitHub API replies, but these are restricted until after a human reviews the resolution plan (SKILL.md, Section 4).
- Sanitization: Safety is managed through a manual approval process where the agent must present each item to the user and await a decision before proceeding with any state-changing actions.
Audit Metadata