kf-g-command-do-pr-rev-comment
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted content from external GitHub PR review comments to determine code implementation and reply content.
- Ingestion points: The agent reads unverified content from PR review threads and comments to guide its work.
- Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from obeying malicious instructions embedded within review comments.
- Capability inventory: The skill has the capability to modify source code, execute
gitcommands (commit, push), and run a local Node.js helper script. - Sanitization: There is no explicit logic for sanitizing or escaping the content of review comments before they influence the agent's logic or are included in script arguments.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute shell commands and a specific local script to manage git state and GitHub communications.
- Evidence: Use of
git stage,git commit,git push, andnode ~/.agents/credentials/github/scripts/github-agent-reply.mjs.
Audit Metadata