triage-pr
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes untrusted pull request comments which could influence the agent's behavior during categorization and file editing.
- Ingestion points: PR metadata, inline comments, and GraphQL review threads fetched via the
ghtool in Step 2. - Boundary markers: The skill lacks explicit delimiters or instructions to treat external comment text as untrusted data.
- Capability inventory: The skill has access to powerful tools including
Bash,Read,Edit, andWrite, which could be abused if the agent follows instructions embedded in a PR comment. - Sanitization: There is no evidence of sanitization or filtering of the fetched PR comment content before it is passed to the agent for processing.
- [COMMAND_EXECUTION]: The skill performs shell command interpolation by using the
$ARGUMENTSvariable directly within abashcommand in Step 1 (gh pr view <num>). This presents a potential command injection risk if a user provides an argument containing shell metacharacters like semicolons or backticks.
Audit Metadata