code-review:review-pr

Pass

Audited by Gen Agent Trust Hub on Mar 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to interact with the repository and the GitHub API. Evidence: It uses git status and git diff to analyze local files, and the gh CLI to perform remote API calls.
  • [DATA_EXFILTRATION]: The skill transmits summaries of code changes to the GitHub API to update PR descriptions and post comments. Evidence: Use of gh api and MCP tools to send processed repository content to external GitHub endpoints. This is documented as a standard operational flow for this well-known service.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by incorporating untrusted documentation from the repository into its instruction context.
  • Ingestion points: The skill reads CLAUDE.md, AGENTS.md, constitution.md, and code diffs from the Pull Request being reviewed (Phase 1 and 2).
  • Boundary markers: Absent. No explicit delimiters are used to isolate untrusted file content from the agent's core instructions.
  • Capability inventory: The agent can modify Pull Request descriptions and post inline comments using GitHub API tools.
  • Sanitization: No validation or sanitization is performed on the instructions found in the repository files before they are used to influence the review agents.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 22, 2026, 03:52 AM
Security Audit — agent-trust-hub — code-review:review-pr