pr-review
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes untrusted data in the form of git diffs and file contents from contributor branches. This is an inherent part of its PR review functionality.
- Ingestion points: SKILL.md (Step 1c) captures the full unified diff and untracked file contents to pass to sub-agents.
- Boundary markers: The prompt template for sub-agents (Step 4) uses a structured block format to provide context, though it does not explicitly define unique delimiters for the untrusted diff content itself.
- Capability inventory: The orchestrator utilizes git for repository inspection and the task tool for parallel processing. It is explicitly restricted from executing build tools or applying code fixes.
- Sanitization: The workflow relies on logical cross-checks and a multi-model validation step (dimensions/multi-model.md) to verify the legitimacy of findings before reporting them to the user.
Audit Metadata