review-pr-comments
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill fetches external data from GitHub PR comments and issue timelines to drive its behavior. This represents an indirect prompt injection surface where malicious comments could attempt to influence the agent. The skill instructions address this by requiring validation of suggestions against repository-specific documentation (e.g., AGENTS.md, CLAUDE.md) and local quality gates.
- [SAFE]: The skill interacts with the local file system and repository configuration to run 'project quality gates' (e.g., linting or test scripts). While this involves executing local scripts, it is the primary intended function of the skill to ensure code quality before pushing.
- [SAFE]: The skill performs network operations using the GitHub CLI (
gh) and Git to fetch comments and push code changes. All operations target the current repository context on GitHub, which is a well-known and expected service for this task.
Audit Metadata