pr-review-canvas
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes shell commands such as
gh apiandpython3using variables like owner, repo, and PR number extracted from user input. While standard for this use case, it constitutes a potential injection point if the agent fails to validate these inputs correctly. - [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection (Cross-Site Scripting). It processes untrusted data from GitHub PRs (descriptions and comments) and embeds them into a generated HTML file.
- Ingestion points: Untrusted data enters via
gh apicalls fetching PR details and comments (SKILL.md, Step 1). - Boundary markers: Although the skill instructions include techniques for safe JSON injection, they do not prescribe boundary markers or mandatory escaping for the free-form HTML body generated by the agent.
- Capability inventory: The skill can write files to the local filesystem and start a local web server to display them (SKILL.md, Step 4).
- Sanitization: A basic HTML escaping function is provided in
renderer.jsfor diff rendering, but its application to other PR-derived content in the agent-written HTML is not explicitly required, allowing potentially malicious scripts from a PR to execute in the user's browser.
Audit Metadata