qp-code-review
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the official GitHub (
gh) and GitLab (glab) CLI tools to interact with repository APIs. These commands are used to read pull/merge request metadata, fetch diffs, and post review comments. Use of these tools is documented inreferences/provider-operations.mdand includes specific hostname flags to ensure communication with the correct provider. - [PROMPT_INJECTION]: The skill processes external data including code diffs and issue discussions, which constitutes a surface for indirect prompt injection.
- Ingestion points: External code diffs, issue descriptions, and PR/MR discussions are fetched via provider APIs (documented in
references/provider-operations.md). - Boundary markers:
SKILL.mdexplicitly instructs the agent to treat fetched issue discussions as "untrusted contract evidence". - Capability inventory: The skill can perform write operations including posting comments, resolving threads, and approving PRs/MRs using the
ghorglabCLI. - Sanitization: The skill employs strict identity pinning using commit SHAs and requires explicit user authorization before performing any write operations, reducing the risk of unintended actions triggered by malicious code content.
- [DATA_EXFILTRATION]: Network operations are directed towards well-known repository providers (GitHub and GitLab) to retrieve candidate code and submit reviews. The instructions mandate hostname verification on all CLI calls to prevent redirection and ensure that data is only shared with the intended canonical provider.
Audit Metadata