oh-review

Pass

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it ingests and processes untrusted data from external sources to determine its logic and output.
  • Ingestion points: The agent fetches PR metadata, PR diffs, and Issue content using gh pr view and gh issue view. This content is controlled by repository contributors.
  • Boundary markers: The instructions lack explicit delimiters or system instructions to ignore potential commands or behavioral overrides embedded within the PR or Issue text.
  • Capability inventory: The agent has the ability to execute shell commands, write to the file system (/tmp), and post comments back to GitHub via gh pr review.
  • Sanitization: There is no evidence of filtering or sanitizing the fetched content before the agent evaluates it against requirements.
  • [COMMAND_EXECUTION]: The skill relies on shell command execution via the GitHub CLI (gh) to perform its primary functions. While these commands are standard for a development-oriented skill, they rely on parameters (like PR numbers) parsed from user input or remote metadata, which presents a surface for command injection if not strictly validated by the underlying agent implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 6, 2026, 04:54 PM
Security Audit — agent-trust-hub — oh-review