github-code-review
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted data from GitHub Pull Request metadata (titles, descriptions) and file contents through commands like
gh pr view,curl, andread_file. This content is processed by the agent without explicit boundary markers or instructions to ignore embedded commands, potentially allowing an attacker to influence the agent's review behavior via a malicious PR. - [COMMAND_EXECUTION]: The skill utilizes high-privilege commands including
git,gh, andcurlto interact with both local and remote repositories. It also usespython3 -cto parse JSON data fetched from the GitHub API. These capabilities provide a significant attack surface if the agent's logic is manipulated through malicious input. - [CREDENTIALS_UNSAFE]: The setup logic automatically attempts to harvest the
GITHUB_TOKENby reading local.envfiles and the Git credential cache (~/.git-credentials). While this is functional for the skill's purpose of API authentication, it demonstrates programmatic access to sensitive user credentials.
Audit Metadata