code-review
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting untrusted data from pull request titles, bodies, diffs, and raw code snippets, creating a surface for indirect prompt injection where an attacker could embed instructions within code comments or PR descriptions to influence the agent's review logic.
- Ingestion points: Pull request metadata and diffs are fetched via
gh pr viewandgh pr diff, and code is read from the local workspace or provided via user input. - Boundary markers: The instructions lack specific guidance on using strong delimiters (like XML tags or unique tokens) to isolate the untrusted code content from the agent's core instructions.
- Capability inventory: The skill uses
gitandghCLI tools for repository interaction and a Python validation script for checking output structure; it does not execute the code being reviewed. - Sanitization: There is no evidence of sanitization, filtering, or instruction-stripping performed on the ingested code or PR content before analysis.
Audit Metadata