review-full
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the 'gh' CLI and 'codex review' to perform PR analysis. It includes a specific security requirement to use JSON serialization for API payloads, which prevents command injection risks associated with shell interpolation of untrusted review text.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub PRs, including code, comments, and descriptions. It mitigates injection risks by explicitly instructing the agent to treat this data as 'untrusted evidence' and forbids it from being used as authority to expand tasks or execute instructions.
- [SAFE]: The workflow enforces strict isolation by requiring the creation of private temporary directories outside the user's working tree and using detached checkouts. This prevents the accidental exposure or modification of the user's local, unstaged, or untracked files.
- [SAFE]: The skill defines a narrow 'Review only' scope, explicitly prohibiting subagents from fixing code, committing, merging, or recursively invoking the skill. It also mandates that workers must never post directly to GitHub, ensuring all output is consolidated and reviewed by the coordinator first.
Audit Metadata