pr-review
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of untrusted data. It reads pull request descriptions, review comments, and linked issues via 'gh pr view' and 'gh issue view'. Additionally, it reads documentation files like AGENTS.md, CONTRIBUTING.md, and CLAUDE.md, treating them as 'authoritative' for commands and conventions. An attacker could embed malicious instructions in these files or PR comments to manipulate the agent's behavior. The skill lacks boundary markers or sanitization to differentiate between data and instructions. The agent possesses significant capabilities, including the ability to execute git commands and modify local files.
- [COMMAND_EXECUTION]: The skill executes several command-line utilities to perform its tasks. In addition to standard tools like git and the GitHub CLI (gh), it invokes alembic for database migration head checks. It also calls specialized third-party analysis tools codex and bob to provide secondary code review findings. These tools are used for the skill's primary purpose but represent external dependencies invoked at runtime.
Audit Metadata