hyper-pr-review
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to handle untrusted data from pull requests (titles, bodies, comments), which is a potential surface for indirect prompt injection.\n
- Ingestion points: External data is ingested via
gh pr viewandgh pr difffrom the GitHub platform.\n - Boundary markers: The instructions include a dedicated 'Quarantine the narrative' section that explicitly labels this data as untrusted and commands the agent to ignore any instructions embedded within it.\n
- Capability inventory: The skill uses shell commands (
git,gh) and allows for the execution of reproduction scripts (e.g.,node repro.mjs).\n - Sanitization: The skill mandates a 'trust gate' where code from external or unknown authors must only be executed in disposable, credential-free environments with restricted networking.\n- [COMMAND_EXECUTION]: The skill uses several command-line tools to interact with the repository and environment.\n
- Evidence: Uses
gh(GitHub CLI) for viewing PRs, diffs, and checks. Usesgitfor status, diffs, and listing untracked files. Usessibyl(a vendor resource) for context and memory management.\n- [REMOTE_CODE_EXECUTION]: The skill provides instructions for verifying findings by running tests or reproduction scripts associated with the pull request under review.\n - Mitigation: The skill emphasizes that execution must be handled with caution, recommending static analysis (tracing) when safe isolation is unavailable.
Audit Metadata