kf-g-github-pr-review-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the AI agent to execute a series of local Node.js scripts located in
~/.agents/credentials/github/scripts/to perform GitHub operations. These includegithub-agent-create-pr.mjs,github-agent-update-pr.mjs,github-agent-set-reviewers.mjs,github-agent-comment.mjs,github-agent-review.mjs,github-agent-reply.mjs, andgithub-agent-resolve-thread.mjs. The skill enforces a "bot preflight" check before these commands are run and explicitly prohibits falling back to personal GitHub tokens. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because its primary function involves reading and responding to untrusted external data from GitHub.
- Ingestion points: The agent processes content from GitHub PR comments, issue descriptions, and linked documentation.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands within the processed GitHub content are provided.
- Capability inventory: The agent has the ability to write to the repository by creating PRs, posting comments, resolving review threads, and modifying PR descriptions.
- Sanitization: The instructions do not define any sanitization or validation steps for content retrieved from external GitHub comments before the agent incorporates that content into its own logic or replies.
Audit Metadata