resolve-pr-feedback
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes pull request review comments fetched from GitHub, which are authored by third parties and should be treated as untrusted data.
- Ingestion points: Review thread comments are fetched using the
gh api graphqlcommand inSKILL.md. - Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore instructions potentially embedded within the PR comments.
- Capability inventory: The skill allows the agent to modify the local filesystem, create git commits, and execute
ghCLI commands. - Sanitization: There is no evidence of sanitization or filtering applied to the comment bodies before the agent evaluates and acts upon them.
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands using variables parsed from user-provided input ($ARGUMENTS).
- Evidence: The skill instructs the agent to parse a PR URL or number and interpolate it into commands such as
gh pr checkout <number>and the GraphQL query-F number=<number>. If the agent fails to validate that the input is a legitimate numeric identifier, it could lead to command injection or argument manipulation.
Audit Metadata