rebut
Warn
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell scripts (
preflight.sh,gather-review.sh, andci-status.sh) by constructing paths using the${CLAUDE_PLUGIN_ROOT}environment variable. This dynamic path resolution for executable scripts is a noted pattern for runtime execution. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests untrusted content from pull request comments and possesses capabilities to modify the environment and repository.
- Ingestion points: Gathers all PR review summaries and inline comments via
gather-review.shin Step 1. - Boundary markers: Utilizes 'HARD-GATE' sections that explicitly instruct the agent to never apply or refute suggestions without verification against current code and repository gates.
- Capability inventory: The agent can read files (Step 2), execute local commands such as lint/tests (Step 2), modify source code and commit/push changes via
git(Step 4), and post new comments to the GitHub API (Step 5 and 6). - Sanitization: Relies on the mandatory manual verification process (reproducing the claim and running repo gates) to sanitize the impact of potentially malicious suggestions embedded in comments.
Audit Metadata