pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided input through the
$ARGUMENTSvariable and<fact>tokens, which are directly interpolated into sub-agent prompts and a persistent memory store. - Ingestion points:
$ARGUMENTSin SKILL.md is used to capture PR references, flags, and instructions for therememberoperation. - Boundary markers: No explicit delimiters or 'ignore' instructions are used when passing user-provided flags to the
pr-reviewersub-agent. - Capability inventory: The skill utilizes
ghCLI, GitHub MCP tools for reading PRs, sub-agent dispatch tools (Task/Agent),nodefor script execution, andmcp__lorekit__memory_writefor persistent storage. - Sanitization: The skill performs basic structural validation for the
remembercommand, requiring specific fields (finder, class, path) before writing to memory, and explicitly refuses to suppress certain categories of findings. - [COMMAND_EXECUTION]: The skill executes local commands to interact with the environment and process data.
- Evidence: Uses
gh pr viewto retrieve GitHub PR metadata and executes a local script vianode agents/pr-reviewer/scripts/fingerprint.mjsto calculate rule fingerprints.
Audit Metadata