github-pr
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its processing of untrusted external content.\n
- Ingestion points: The skill ingests data from pull request diffs, summaries, and repository-specific
CLAUDE.mdconfiguration files viagh pr diff,gh pr view, and file reading tools.\n - Boundary markers: There are no instructions in the orchestrator prompt for utilizing delimiters (such as XML tags) or specific guidance to ignore potential instructions embedded within the PR content.\n
- Capability inventory: The skill is authorized to post comments back to the GitHub PR using the
gh pr commenttool based on the outcome of its analysis.\n - Sanitization: The skill does not perform explicit sanitization or filtering of the ingested PR content before passing it to the reviewing LLM agents.\n
- Mitigation: The architecture employs five parallel Sonnet agents and a secondary Haiku-based scoring agent, which acts as a structural defense against simple injection attempts by requiring consensus and high confidence.
Audit Metadata