make-pr-easy-to-review
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (GitHub PRs) which creates a surface for indirect prompt injection attacks.
- Ingestion points: The workflow in
SKILL.mdusesgh pr view <PR> --json title,headRefName,baseRefName,state,commitsto fetch PR data into the agent context. - Boundary markers: The instructions do not define clear delimiters or "ignore" instructions when the agent processes the fetched PR content (titles, descriptions, or commit messages).
- Capability inventory: The skill possesses significant capabilities, including the ability to execute shell commands (
git,gh) and rewrite git history (rebase/force-push). - Sanitization: There is no evidence of sanitization or filtering applied to the data retrieved from the
ghcommand before it is used to influence the agent's actions or the PR description updates.
Audit Metadata