resolve-pr-comments
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub PR comments, creating an attack surface where malicious input could influence agent behavior.
- Ingestion points: Review comments are fetched from the GitHub API using
scripts/pr-resolver.shand stored in temporary cluster files within the.ada/data/pr-resolver/directory. - Boundary markers: The skill generates markdown cluster files that wrap individual comment bodies in triple-backtick code blocks and separate them with clear headers, providing some structural isolation.
- Capability inventory: The subagents spawned by this skill have the authority to modify the project's source code (applying fixes) and interact with GitHub threads using the provided resolution and dismissal scripts.
- Sanitization: The tool includes technical sanitization to remove control characters from JSON input, but it does not perform semantic analysis or filtering to detect or mitigate malicious instructions hidden within the natural language text of the comments.
Audit Metadata