api-review
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Command Execution]: The skill instructions utilize shell commands including
git,grep, and the GitHub CLI (gh) to extract version information, commit logs, and documentation changes. These operations are standard for the skill's intended purpose of auditing codebase changes. - [Indirect Prompt Injection Surface]: The skill processes external data such as Pull Request titles and descriptions fetched via the GitHub API. This constitutes a potential injection surface; however, the skill explicitly instructs the agent to sanitize this content by escaping HTML characters before including it in the final HTML artifact, which helps mitigate potential risks associated with rendering untrusted data.
- [External Resource Interaction]: The skill references and interacts with official repositories under the vendor's organization on GitHub. These interactions are used to fetch repository tags, compare branches, and read file contents necessary for cross-port API reviews (Python, Java, .NET).
Audit Metadata