om-auto-review-pr
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request diffs, bodies, and comments to determine review outcomes and drive autonomous fixes. Although it instructs the agent to ignore directives in these fields, the wide range of ingested data represents a significant attack surface.
- Ingestion points: Pull request metadata (title, body), diff content, and all conversation/review comments are retrieved and processed as findings (Step 2,
references/pr-metadata.md). The skill also loads a local config file.ai/agentic.config.jsonand a local skill extension.ai/skills/om-auto-review-pr/SKILL.mdfrom the repository. - Boundary markers: The skill explicitly instructs the agent to treat repo and tracker content as data, not instructions, and to report suspected prompt injection (
references/agentic-setup.md). - Capability inventory: The agent has the capability to write files (autofix loop), execute shell commands via
validation.commands, and interact with the PR tracker (commenting, labeling, reassigning). - Sanitization: The skill specifies regex-based validation (
^[A-Za-z0-9._/-]+$) and shell quoting for externally-sourced values used in shell or path interpolation. - [REMOTE_CODE_EXECUTION]: The skill executes arbitrary commands defined in the repository's configuration (
validation.commands) and performs dependency installation (npm install,cargo install, etc.) based on the repository's lockfiles in an isolated worktree. If the repository or a pull request is untrusted, this configuration could be manipulated to execute malicious code on the agent's host environment (references/worktree-setup.md,references/review-report.md). - [DYNAMIC_EXECUTION]: The skill features a mechanism to load and apply repository-local extensions to its own instructions from
.ai/skills/om-auto-review-pr/SKILL.md(references/agentic-setup.md). Loading and following instructions from the untrusted repository being reviewed creates a high-risk dynamic execution path where the agent's core logic can be influenced by the target of the review. - [COMMAND_EXECUTION]: The skill makes extensive use of shell commands for complex git operations, worktree management, and executing the project's build and test toolchain.
Audit Metadata