create-review-comment
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external content from GitHub Pull Requests, including PR bodies, comments, and diffs. This creates a surface for indirect prompt injection where malicious content within a PR could attempt to manipulate the agent's drafting logic or internal instructions.
- Ingestion points: The workflow fetches PR context, comments, and diffs using the
ghtool as described inreferences/workflow.md. - Boundary markers: No explicit delimiters or specific instructions are defined to separate untrusted PR data from the agent's internal instructions during the analysis phase.
- Capability inventory: The agent has the capability to post comments to GitHub via the
ghtool. - Sanitization: The workflow includes a filtering step to select only important findings and enforces a strict "no-post-without-approval" gate, requiring manual user intervention before any data is written back to GitHub.
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) to retrieve repository context and pull request details from the environment. This is standard tool usage consistent with the skill's primary purpose.
Audit Metadata