pr-takeover
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and acts on pull request review comments without isolation or sanitization.
- Ingestion points: Review thread bodies are fetched using the GitHub API in
SKILL.md(Step 1) andreferences/github-commands.md. - Capability inventory: The agent is authorized to perform
git push,gh pr merge, and various GitHub API mutations (such as resolving threads or dismissing reviews) based on the input from these comments. - Boundary markers: The instructions lack delimiters or warnings to treat review comments strictly as data rather than instructions.
- Sanitization: No evidence of validation or filtering for comment content is provided.
- [EXTERNAL_DOWNLOADS]: The skill references remote markdown files for additional instructions and documentation from the author's GitHub repository (
nexu-io/looper). While these are vendor resources, they provide a remote update path for the agent's operating instructions. - [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh),git, and an optional background daemon (looper) to automate pull request workflows and repository management.
Audit Metadata