review-pr
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on system commands including 'git', 'gh', 'jq', and 'curl' to manage repository state and query the GitHub API. It includes a functional routine to copy the internal helper script 'wait-for-reviews.sh' to a temporary directory ('$TMPDIR') for execution, which is described as a workaround for sandbox environments that restrict reading from symlinked skill paths.- [PROMPT_INJECTION]: The skill processes external PR data and review feedback, presenting an indirect prompt injection surface. This is mitigated through explicit instructions for the agent to triage all findings against a 'SCOPE' contract defined by the PR title and description before making code changes.
- Ingestion points: PR comments, review bodies, and threads fetched via the GitHub REST/GraphQL APIs (SKILL.md, Section 3).
- Boundary markers: The 'SCOPE' contract (defined in Section 1 and enforced in Section 4) serves as a logical boundary for acceptable modifications.
- Capability inventory: File system write operations, 'git commit', 'git push', and GitHub API interactions.
- Sanitization: Relies on agent-led triage and verification of required checks as specified in the skill instructions.- [SAFE]: Authentication is handled using standard environment variables ('GH_TOKEN') to communicate with official GitHub API endpoints. No obfuscation, persistence mechanisms, or exfiltration of sensitive local data (e.g., SSH keys or AWS credentials) were observed.
Audit Metadata