pr-review-comments
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
prcCLI tool to fetch pull request metadata and comments. - [EXTERNAL_DOWNLOADS]: The tool interacts with GitHub's infrastructure to retrieve content from repositories, which may include private data if credentials are configured in the environment.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests pull request comments provided by external users without sufficient boundary markers or sanitization.
- Ingestion points: Pull request comment bodies and code references retrieved by the
prctool are loaded into the agent's context (SKILL.md). - Boundary markers: There are no instructions to use delimiters or ignore instructions embedded within the fetched comments.
- Capability inventory: The agent typically has capabilities to write to the file system and execute build tools, which could be abused if malicious instructions in a PR comment are obeyed.
- Sanitization: There is no evidence of filtering or validation of the retrieved comment content before it is processed by the AI.
Audit Metadata