review-pr-comments
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically GitHub PR comments and reviews.
- Ingestion points: Instructions in
SKILL.mddirect the agent to "Collect all open feedback: human reviews, bot comments, unresolved and outdated threads, failing checks." - Boundary markers: The skill lacks explicit instructions to treat PR comments as potentially untrusted data or to ignore embedded commands within them.
- Capability inventory: The agent is authorized to perform git operations (commit and push) and poll CI status, which could be abused if an attacker places malicious instructions in a PR comment that the agent then follows during triage.
- Sanitization: No sanitization, validation, or escaping logic is specified for the processed feedback content.
Audit Metadata