oh-review
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it ingests and processes untrusted data from external sources to determine its logic and output.
- Ingestion points: The agent fetches PR metadata, PR diffs, and Issue content using
gh pr viewandgh issue view. This content is controlled by repository contributors. - Boundary markers: The instructions lack explicit delimiters or system instructions to ignore potential commands or behavioral overrides embedded within the PR or Issue text.
- Capability inventory: The agent has the ability to execute shell commands, write to the file system (
/tmp), and post comments back to GitHub viagh pr review. - Sanitization: There is no evidence of filtering or sanitizing the fetched content before the agent evaluates it against requirements.
- [COMMAND_EXECUTION]: The skill relies on shell command execution via the GitHub CLI (
gh) to perform its primary functions. While these commands are standard for a development-oriented skill, they rely on parameters (like PR numbers) parsed from user input or remote metadata, which presents a surface for command injection if not strictly validated by the underlying agent implementation.
Audit Metadata