code-review:review-pr
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to interact with the repository and the GitHub API. Evidence: It uses git status and git diff to analyze local files, and the gh CLI to perform remote API calls.
- [DATA_EXFILTRATION]: The skill transmits summaries of code changes to the GitHub API to update PR descriptions and post comments. Evidence: Use of gh api and MCP tools to send processed repository content to external GitHub endpoints. This is documented as a standard operational flow for this well-known service.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by incorporating untrusted documentation from the repository into its instruction context.
- Ingestion points: The skill reads CLAUDE.md, AGENTS.md, constitution.md, and code diffs from the Pull Request being reviewed (Phase 1 and 2).
- Boundary markers: Absent. No explicit delimiters are used to isolate untrusted file content from the agent's core instructions.
- Capability inventory: The agent can modify Pull Request descriptions and post inline comments using GitHub API tools.
- Sanitization: No validation or sanitization is performed on the instructions found in the repository files before they are used to influence the review agents.
Audit Metadata