respond-to-comments
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external, untrusted data in the form of GitHub PR comments and review feedback. An attacker or a compromised bot could craft a comment containing malicious instructions (indirect prompt injection) to manipulate the agent's logic, such as tricking it into introducing vulnerabilities, deleting code, or exfiltrating data through the PR reply mechanism.
- Ingestion points: The skill fetches comments from multiple external sources via the GitHub API:
repos/$REPO/pulls/$PR/comments,repos/$REPO/issues/$PR/comments, andrepos/$REPO/pulls/$PR/reviews(Step 2). - Boundary markers: Absent. The agent is instructed to read and reason from the comment body directly without using specific delimiters or safety instructions to isolate the untrusted text.
- Capability inventory: The agent possesses significant capabilities, including reading and writing files, executing Git commands (commit and push in Step 5), and making GitHub API calls to post replies.
- Sanitization: Absent. While Step 4 instructs the agent to "investigate" and "check whether the claim actually holds" against the source code, this is a functional verification rather than a security sanitization or sandboxing of the input text.
- [COMMAND_EXECUTION]: The skill relies on the
gh(GitHub CLI) utility and shell commands to resolve repository information, fetch comments, and interact with the GitHub API. These operations are essential to the skill's workflow for PR management.
Audit Metadata