make-pr-easy-to-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub Pull Requests which could contain malicious instructions designed to hijack the agent's execution flow.
- Ingestion points: Pull Request descriptions, commit messages, and repository metadata (such as branch names) retrieved via
gh pr viewandgit fetchinSKILL.md. - Boundary markers: The instructions lack specific delimiters or guardrail prompts to ensure the agent disregards natural language instructions found within the PR content it is tidying.
- Capability inventory: The skill has significant write capabilities, including the ability to rewrite git history, force-push changes, and modify PR descriptions, creating a risk if the agent is misled by malicious PR data.
- Sanitization: No explicit sanitization or validation of the PR metadata is defined before these values are interpolated into shell command templates like
git fetch origin <headRefName>. - [COMMAND_EXECUTION]: The skill relies on the execution of multiple shell commands to perform its core functions. It uses
gh(GitHub CLI) to view PR data andgitfor tree verification and history manipulation (git rev-parse,git fetch,git diff). While these are standard development tools, they are used to execute logic based on inputs derived from external repository state.
Audit Metadata