read-only-gh-pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Shelltool to execute GitHub CLI (gh) commands. It attempts to mitigate the risk of unauthorized mutations by requiring the agent to source a security wrapper script (scripts/activate-gh-readonly.sh) that shadows thegh,command, andenvcommands to intercept and block non-read-only API calls. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external pull requests, which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: The skill ingests data from GitHub pull request metadata, diffs, file contents, and comments through commands like
gh pr view,gh pr diff, and variousgh apiendpoints mentioned inSKILL.mdandreferences/github-cli-map.md. - Boundary markers: The skill instructions do not define specific delimiters or boundary markers to distinguish untrusted external content from system instructions during processing.
- Capability inventory: The skill utilizes
Shell,Read,Grep,Glob,LS,WebSearch, andSemanticSearchtools. - Sanitization: No automated sanitization, filtering, or validation is performed on the data retrieved from external GitHub repositories before the agent processes it.
Audit Metadata