deep-review
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates its pipeline through a suite of Python scripts that execute system commands. These include 'git' for repository diffing and 'gh' (GitHub CLI) for fetching pull request information. The 'run_jobs.py' script executes a command template, allowing the agent to dispatch review tasks to subagents or external tools like 'compozy'.
- [EXTERNAL_DOWNLOADS]: The skill fetches code diffs, pull request titles, and descriptions from GitHub via the 'gh' CLI. It also facilitates publishing findings back to GitHub through API calls. These interactions target a well-known service (GitHub) as part of the tool's core functionality.
- [PROMPT_INJECTION]: As the skill reviews untrusted code and PR data, it is subject to indirect prompt injection risks. The skill incorporates multiple defensive layers:
- Ingestion points: Repository files and pull request metadata (Step 1 and Step 3).
- Boundary markers: Prompts in 'assets/PROMPT.md' use explicit instructions to agents to focus on hunks, ignore non-code content, and adhere to a specific output contract.
- Capability inventory: The pipeline uses 'subprocess.run', 'git', and 'gh' CLI tools.
- Sanitization: The skill uses fixed prompt templates and validates all subagent outputs against a strict JSON schema before merging results.
Audit Metadata