gh-review-triage
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub Pull Request (PR) bodies and titles to perform its core function.
- Ingestion points: Data enters the agent's context during Phase 1 (
gh search prs) and Phase 2 (gh pr view) as described inSKILL.md. - Boundary markers: There are no explicit instructions or delimiters defined to prevent the LLM from following instructions that might be hidden within a PR title or body.
- Capability inventory: The skill possesses network capabilities through the
ghCLI and requires local authentication to a GitHub account. It performs read-only operations to fetch repository data. - Sanitization: The skill implements a length limit (capping the PR body at 500 characters) in Phase 4, which limits the volume of data processed but does not sanitize the content for potential injection attacks.
Audit Metadata