address-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub pull request comments and local documentation, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: Data is ingested via the
gh apifrom GitHub review threads (pullRequest.reviewThreads) and general comments (pullRequest.comments), as well as from local files in the repository. - Boundary markers: The instructions lack explicit boundary markers or delimiters to separate the external comment content from the agent's internal instructions.
- Capability inventory: The skill utilizes the GitHub CLI to perform network write operations (POSTing replies, resolving threads) and has the capability to modify repository source code.
- Sanitization: There is no evidence of sanitization or validation performed on the external content before it is presented to the agent for triage and action.
Audit Metadata