pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub pull requests, such as titles, descriptions, and code diffs. This creates a surface for indirect prompt injection where an attacker could embed malicious instructions to influence the agent's review verdict or actions.\n
- Ingestion points: PR metadata and diffs are retrieved in
SKILL.mdviagh pr viewandgh pr diff.\n - Boundary markers: There are no explicit instructions to the agent to treat this data as untrusted or to ignore embedded instructions.\n
- Capability inventory: The skill can post review comments and approve pull requests using the
gh apitool, and usesgh pr viewandgh pr diffto read data.\n - Sanitization: No sanitization or validation of the PR content is performed before processing.\n- [COMMAND_EXECUTION]: The skill interpolates user-provided PR identifiers directly into shell commands (e.g.,
gh pr view <number>). If the agent fails to strictly validate that the input is a numeric ID or valid URL, it could be exploited for command injection.
Audit Metadata