Skills
Navigate
skills/metyatech/skill-pr-review-workflow/pr-review-workflow/Gen Agent Trust Hub

pr-review-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to install and execute the compose-agentsmd utility from the metyatech organization via npx or npm to synchronize rules in the AGENTS.md file.
  • [COMMAND_EXECUTION]: The agent is directed to perform various shell-based operations including running verification suites, executing Git commands for branch management (merge, sync, delete), and interacting with the GitHub REST API (via DELETE and POST requests) to manage reviewers and notification statuses.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub PR comments and notification threads.
  • Ingestion points: PR review comments and notification thread content (referenced in SKILL.md).
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for external comment processing.
  • Capability inventory: The agent has the ability to execute shell commands (git, tests) and perform authenticated GitHub API operations.
  • Sanitization: The instructions do not specify sanitization or validation of the content within the review comments or notifications.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:35 AM