validate-pr-review-comments
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes pull request review comments, which are untrusted external data sources. A malicious reviewer could include instructions in a comment designed to override the agent's logic or trigger unintended file modifications.
- Ingestion points: Pull request comments are fetched using
gh api graphql(Step 2 in SKILL.md). - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the processing logic.
- Capability inventory: The skill can modify the local filesystem (working tree), execute shell commands for validation, and make network requests via the GitHub API (
gh api). - Sanitization: The skill does not perform sanitization or filtering of the comment body before using it to guide code changes.
- [COMMAND_EXECUTION]: The skill executes shell commands found in repository metadata to validate code changes.
- Evidence: Step 5 ("Validation") instructs the agent to "Run the repository's documented test/lint/typecheck commands (from its README, Makefile, CI config, or AGENTS.md)".
- Risk: If a malicious pull request modifies these configuration files, the agent will execute the injected commands when attempting to validate the PR feedback.
- [DYNAMIC_EXECUTION]: The skill determines which commands to execute at runtime based on the contents of files within the target repository.
- Evidence: The validation logic dynamically discovers commands from
README,Makefile, and other local files rather than using a static, pre-defined set of safe tools.
Audit Metadata