github-pr-review-fix
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data (GitHub PR comments) and uses it to drive automated code modifications via sub-agents.
- Ingestion points: Step 2 fetches PR comments and thread replies directly from the GitHub API using
gh api repos/{owner}/{repo}/pulls/{number}/comments. - Boundary markers: The sub-agent prompt template in Step 3 interpolates
{comment_body}and{thread_replies}directly into its instructions without any delimiters (e.g., XML tags) or explicit warnings to the sub-agent to ignore instructions contained within the comment text. - Capability inventory: The skill has the capability to modify local source code files ('fixes legitimate issues') and perform network operations via the GitHub API (Step 4: resolve threads and post replies).
- Sanitization: There is no evidence of sanitization, filtering, or validation performed on the comment content before it is processed by the sub-agent. A malicious actor could provide a comment that looks like a valid fix request but contains instructions to inject a backdoor or modify unintended files.
Audit Metadata