api-review
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill includes comprehensive instructions to treat all pull request and issue content as untrusted data. It explicitly directs the agent to ignore any embedded instructions or adversarial content, providing a dedicated checklist section for handling potential injection attempts (ingestion points:
gh pr view,gh issue view, andgit diffinSKILL.md; boundary markers and sanitization: present inSKILL.mdandreferences/api-review-checklist.md; capability inventory:gitandghinSKILL.md). - [COMMAND_EXECUTION]: The tool uses
gitandghCLI commands to retrieve the necessary context for reviewing API designs. These operations are standard for development workflows and are restricted to retrieving information for an in-chat report. - [EXTERNAL_DOWNLOADS]: The skill connects to GitHub's official services through the
ghtool to fetch pull request metadata and comments. This interaction with a well-known service is documented as part of the intended workflow.
Audit Metadata