review-pr-integration
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Employs standard GitHub CLI commands (gh pr, gh api) to process PR data and manage reviews, which is consistent with its documented purpose for developer workflow automation.
- [EXTERNAL_DOWNLOADS]: Retrieves PR content, code diffs, and CI status from GitHub's official services. These operations are essential for functionality and target a well-known trusted service.
- [PROMPT_INJECTION]: The skill processes external data from PR bodies and diffs. While this represents a theoretical indirect prompt injection surface (Ingestion points: PR body and code diffs; Boundary markers: Absent; Capability inventory: PR comment creation via gh api; Sanitization: Absent), it is an inherent part of the review workflow and is handled safely within the context of the user's repository access.
Audit Metadata