github-pr-review-fix
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from GitHub PR comments and feeds it into a sub-agent prompt with file-modification capabilities.
- Ingestion points: Untrusted content is fetched via
gh apicalls to the GitHub pull request comments and issue comments endpoints. - Boundary markers: The sub-agent prompt uses basic headers to demarcate the comment body but lacks strong delimiters or instructions to ignore embedded agent-steering commands.
- Capability inventory: Sub-agents have the ability to read and write to the local filesystem (Phase 1 and 2 of the sub-agent prompt). The skill also interacts with the GitHub API to resolve threads and post replies.
- Sanitization: No sanitization or escaping of the fetched comment content is performed before it is passed to the sub-agent.
- [COMMAND_EXECUTION]: The skill constructs
ghCLI commands using variables populated by LLM output (e.g., "summary", "reason"). This presents a risk of shell command injection if the platform's execution layer does not securely handle argument passing, potentially allowing a malicious comment to trigger arbitrary local commands through the sub-agent's generated response.
Audit Metadata