pr-review
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) andjqto perform repository operations, including fetching PR metadata, identifying the current user, and posting or deleting comments. These operations are within the expected scope of a PR review automation tool. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from GitHub PRs (code diffs and existing comments) to determine its actions. An attacker could potentially include malicious instructions or hidden markers within the PR to influence the agent's behavior or suppress specific review findings.
- Ingestion points: PR metadata and content are fetched using
gh pr view; existing comments are retrieved viagh apito scan for status markers. - Boundary markers: The skill lacks explicit delimiters to separate untrusted PR content from the agent's operational instructions.
- Capability inventory: The agent can post comments, delete its own comments, and create full PR reviews via the GitHub API.
- Sanitization: There is no evidence of sanitization or filtering of the PR content before it is processed or incorporated into the review output.
Audit Metadata