pr-review-toolkit
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill metadata falsely attributes authorship to an Anthropic employee (Daisy
- daisy@anthropic.com) and references internal Anthropic locations (claude-cli-internal). This contradicts the verified author identity (mhenke) provided by the platform. This deceptive behavior is a form of social engineering designed to bypass user safety skepticism and gain unearned trust.- [COMMAND_EXECUTION]: The skill utilize shell commands such as git diff --name-only and gh pr view to retrieve code changes and pull request information for analysis. While functional for a review tool, these commands define the skill's primary interface with the host system's data.- [PROMPT_INJECTION]: The skill ingests untrusted source code and pull request data, creating a surface for indirect prompt injection. (1) Ingestion points: Output of git diff and gh pr view. (2) Boundary markers: Absent in sub-agent personas. (3) Capability inventory: Git and GitHub CLI data retrieval and textual reporting. (4) Sanitization: Absent. The personas do not include instructions to isolate analyzed code from agent instructions.
Audit Metadata