create-review-comment
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a processing layer for untrusted external data which could contain malicious instructions.
- Ingestion points: Fetches pull request context including body, comments, review comments, and diffs via the GitHub CLI (
gh) inreferences/workflow.md. - Boundary markers: The instructions do not define boundary markers or delimiters to isolate untrusted PR content from agent instructions.
- Capability inventory: Uses the GitHub CLI for retrieval and coordinates with multiple subagents for substantive review and validation.
- Sanitization: There is no evidence of sanitization or escaping of external content before interpolation into prompts.
- [DATA_EXFILTRATION]: The final output format defined in
references/workflow.mdincludes the internal review artifact path. While intended for user auditability, this technically discloses internal file system directory structures to the user.
Audit Metadata