heyeddi-pr-review
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) to retrieve pull request metadata and diffs. The implementation inscripts/_skill_cli.pyis secure: it usessubprocess.runwithshell=Falseand resolves the executable path viashutil.which. This prevents shell injection and path-based attacks. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted content from Pull Requests (titles, descriptions, and comments). It implements a "Security by Design" approach to mitigate indirect prompt injection:
- Ingestion points: PR metadata is fetched in
scripts/fetch_pr_context.py. - Boundary markers: Content is wrapped in
<<<UNTRUSTED_EXTERNAL_CONTENT>>>tags using the logic inscripts/_untrusted_doc.py. - Capability inventory: The skill can read project files and execute local commands through the
ghCLI. - Sanitization: The skill explicitly instructs the agent (via
context/ANTI_PATTERNS.md) to treat metadata fields as data only and to ignore any embedded instructions.
Audit Metadata