pr-comment
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill metadata description includes an instruction to 'Always use this skill for ANY PR comment writing, even if the user doesn't explicitly mention it.' This is an attempt to override the agent's natural tool selection or intent recognition logic to enforce a specific behavioral pattern.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data in the form of GitHub Pull Request content, code, and comments.
- Ingestion points: The skill instructions imply the ingestion of PR titles, descriptions, code diffs, and existing conversation threads (SKILL.md).
- Boundary markers: There are no boundary markers or delimiters defined to separate untrusted PR data from the agent's instructions.
- Capability inventory: While the skill itself is markdown-based, it is intended to be used by an agent that typically possesses file-writing and network capabilities (GitHub API access).
- Sanitization: There is no mention of sanitizing or escaping the content retrieved from Pull Requests, which could allow an attacker to embed instructions within a PR that the agent might inadvertently follow while 'Jack' is reviewing it.
Audit Metadata