review-pr
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts (
scripts/pr,scripts/pr-review) and system commands (git,gh,rg). These are used to manage PR worktrees, fetch diffs, and perform search operations within the codebase. - [PROMPT_INJECTION]:
- Ingestion points: Processes untrusted external content from Pull Request descriptions and diffs via
gh pr diffandgit log. - Boundary markers: The skill uses structured JSON and Markdown templates for review findings, providing a clear schema for the agent's output.
- Capability inventory: The skill allows editing PR metadata (assigning reviewers) and executing tests via a local wrapper script. All activities are scoped to specific worktree directories.
- Sanitization: The instructions mandate a read-only execution contract and artifact validation steps to ensure that the analysis remains within its intended scope.
Audit Metadata