review-remediation
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is inherently designed to ingest and act upon data from untrusted external sources, specifically pull request comments, review bodies, and check annotations. An attacker could embed malicious instructions within these surfaces to trick the agent into performing unauthorized code changes or exfiltrating data.
- Ingestion points: The workflow identifies PR reviews, bodies, inline comments, issue comments, check runs, and annotations as primary data sources (SKILL.md, Workflow Step 1).
- Boundary markers: The instructions lack explicit delimiters or warnings to treat feedback content strictly as data rather than instructions, although it notes that reviewer patches should be treated as hypotheses (SKILL.md, Workflow Step 2).
- Capability inventory: The agent has the ability to read and write files during remediation (SKILL.md, Workflow Step 4) and execute shell commands for testing and building (SKILL.md, Workflow Step 5).
- Sanitization: No explicit sanitization or filtering of the feedback content is mentioned beyond a manual reasoning step to verify the finding.
- [COMMAND_EXECUTION]: The skill performs repository-specific operations including testing, building, linting, and security checks (SKILL.md, Workflow Step 5). While these are standard development tasks, they are triggered by external PR feedback, which could potentially be manipulated to execute arbitrary commands if the repository's build scripts are compromised or if the agent is misled into running unexpected tools.
Audit Metadata