pr-review
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is explicitly instructed to load and obey rules from external files within the repository it is reviewing.
- Ingestion points: The skill reads instructions from
.ai-factory/skill-context/pr-review/SKILL.md,.ai-factory/RULES.md,CHECKLIST.md, andCLAUDE.md(Step 0.2 and 0.3). - Boundary markers: There are no explicit markers or 'ignore embedded instructions' warnings provided to the agent when processing these external files; instead, the skill specifically commands the agent to honor and prioritize them.
- Capability inventory: The skill utilizes the GitHub CLI (
gh) to read private repository data and post public comments/reviews, providing a significant impact vector if the agent is manipulated. - Sanitization: No sanitization or validation of the content within these external rule files is performed before they are incorporated into the agent's logic.
Audit Metadata