audit-ready-pr-reviewer
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool to execute a local Node.js script located at
plugins/grc-engineer/scripts/review-pr.js. This script implements the core compliance auditing functionality described in the skill and is a resource provided by the vendor. - [PROMPT_INJECTION]: The skill processes untrusted pull request diffs, creating a surface for indirect prompt injection where malicious instructions could be embedded within code changes to influence the agent's behavior.
- Ingestion points: External data enters the agent context via pull request diffs fetched for analysis as described in SKILL.md.
- Boundary markers: The documentation does not mention the use of boundary markers or instructions for the agent to disregard instructions found within the diff content.
- Capability inventory: The skill utilizes the Bash tool to execute the review script.
- Sanitization: There is no mention of sanitization, filtering, or validation of the PR content before it is processed by the agent.
Audit Metadata