heyeddi-pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from Pull Request titles, bodies, and comments which could contain malicious instructions. Ingestion points: Data enters the context via scripts/fetch_pr_context.py which fetches metadata from GitHub. Boundary markers: The skill uses explicit delimiters
<<<UNTRUSTED_EXTERNAL_CONTENT>>>defined in scripts/_untrusted_doc.py to wrap external data. Capability inventory: The skill can execute shell commands via the gh CLI and write review reports to the local file system. Sanitization: External content is wrapped in markers and the system instructions in SKILL.md and context/ANTI_PATTERNS.md explicitly command the agent to treat these fields as data only and ignore embedded instructions. - [COMMAND_EXECUTION]: The skill executes system commands to interact with Git and GitHub. This is implemented in scripts/_skill_cli.py using subprocess.run with shell=False and shutil.which for secure path resolution, minimizing the risk of command injection.
Audit Metadata