cmd-pr-follow-up
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local CLI tools including
gitandgh(GitHub CLI) to determine the repository's default branch, list tracked files, and generate diffs for analysis. - Evidence:
gh repo view --json defaultBranchRef,git remote show origin, andgit diff <base>...HEADcommands in the 'Determine Scope' section. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted data (source code and git diffs) from the repository. While it analyzes this data for code review purposes, it does not implement explicit boundary markers or instructions to the agent to ignore any potential instructions embedded within the analyzed files.
- Ingestion points: File contents read via
git diffand full file reads of changed files. - Boundary markers: Absent; no specific delimiters or instructions provided to separate code from agent instructions.
- Capability inventory: The skill allows the agent to modify files directly and execute shell commands for scope determination.
- Sanitization: Absent; the skill processes raw file content directly.
Audit Metadata