autopilot-pr-review-scheduler
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill evaluates scheduling eligibility based on external inputs, specifically GitHub pull request comments and CODEOWNERS metadata. While this is the intended mechanism for the skill's logic gate, it presents a surface where external content can influence agent behavior.
- Ingestion points: Pull request comments, submitted reviews, and the CODEOWNERS file are read to determine scheduling eligibility (SKILL.md).
- Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the external comment content.
- Capability inventory: The skill initiates worker sessions (autopilot-pr-review-worker) and executes local GitHub CLI commands (SKILL.md, assets/fan-out-pool.md).
- Sanitization: No explicit sanitization or filtering of the retrieved comment text is described before it is evaluated by the logic gate.
- Subprocess Execution: The skill invokes the GitHub CLI (gh) to retrieve pull request information.
- Evidence: The skill uses
gh pr listwith specific label filters to identify candidates for the review queue, which is a standard administrative operation for a scheduling task (SKILL.md).
Audit Metadata