reviewing-prs
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests (titles, bodies, diffs, and comments). It contains explicit security instructions to ignore any commands embedded in this data and to avoid echoing untrusted text verbatim, mitigating the risk of indirect prompt injection.
- Ingestion points: PR data is retrieved in SKILL.md via scripts/get_pr.sh, scripts/get_pr_diff.sh, and scripts/get_comments.sh.
- Boundary markers: The skill provides negative constraints to ignore instructions found in PR content and to paraphrase instead of echoing.
- Capability inventory: The skill executes local bash scripts for data retrieval and writes a JSON decision file to the repository root.
- Sanitization: The instructions state that a downstream process performs final validation and sanitization of the generated review-decision.json file.
- [COMMAND_EXECUTION]: The skill executes a limited set of local bash scripts (scripts/*.sh) to interact with the repository. These operations are restricted to read-only actions (fetching PR details, diffs, and labels) and do not allow for state-changing operations like posting comments or merging code.
- [DATA_EXFILTRATION]: The get_dependency_releases.sh script performs network requests to the GitHub API to fetch release notes. This is a legitimate operation for dependency auditing and targets a well-known service.
Audit Metadata