review-anvil-improve-pr
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external GitHub Pull Requests which could contain malicious instructions.
- Ingestion points: Pull Request metadata (title, author), PR body, and complete status-aware review history are fetched using the 'gh' CLI and processed in Step 2.
- Boundary markers: The skill acts as an orchestrator and relies on the 'review-anvil' engine (invoked in Step 4) for prompt interpolation and boundary management.
- Capability inventory: The skill can execute 'git push' to update remote code, and 'gh api' to create or patch Pull Request comments (Steps 5 and 6).
- Sanitization: Data processing is performed using 'jq' for structured JSON parsing and shell script logic within 'pr-helper.sh' to validate PR state before action.
- [COMMAND_EXECUTION]: The skill performs shell command execution to manage the repository and interact with the GitHub API.
- It utilizes 'git' for branch verification, committing changes, and pushing to the origin server.
- It uses 'gh' (GitHub CLI) for authentication, PR history retrieval, and comment management.
- It executes a local helper script ('pr-helper.sh') for orchestration. The skill includes a security-critical instruction in Step 1 to resolve this script only from trusted skill roots, specifically warning against executing versions found within the project's own worktree to prevent execution of untrusted local code.
Audit Metadata