review-reminders
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local utility script
scripts/pending-reviews.shto interact with the system environment. - The script uses the GitHub CLI (
gh) to perform authenticated GraphQL and REST API queries. - It uses
jqto parse and transform the JSON data for the agent. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via data retrieved from GitHub.
- Ingestion points: Pull request titles and reviewer login handles are ingested from the GitHub API and passed to the agent context.
- Boundary markers: The instructions in
SKILL.mddo not utilize explicit boundary markers or delimiters (like XML tags or triple quotes) to quarantine PR titles from instructions. - Capability inventory: The skill is limited to drafting text responses (summaries and messages); it does not possess file-writing or further network-write capabilities.
- Sanitization: Data from GitHub is used directly in the generated markdown output without validation or escaping against instruction-like content.
Audit Metadata