PR Review
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from pull request descriptions and comments, which could contain malicious instructions designed to subvert the agent's review logic. * Ingestion points: Pull request metadata, descriptions, and existing comments fetched via 'get_pr_comments.sh' or 'read_url_content'. * Boundary markers: Not used in instructions for handling external data. * Capability inventory: Ability to post comments to GitHub and apply local code modifications. * Sanitization: No explicit sanitization of ingested content. * Mitigation: The skill mandates that the agent must obtain explicit written confirmation from the user before posting any comments to GitHub.
- [COMMAND_EXECUTION]: Custom bash scripts including 'post_inline_comment.sh' and 'submit_pr_review.sh' construct temporary file paths in '/tmp' using the '$PR_NUMBER' variable. While the risk is mitigated by the directory prefix, unvalidated user input could theoretically be used for path traversal or file manipulation in the temporary directory.
Audit Metadata