pr-comments-address
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of GitHub PR comments, which could potentially contain malicious instructions or prompt injection attempts designed to trick the agent into performing unauthorized code changes.
- Ingestion points: Comments are fetched using
gh pr view <PR> --json reviews,comments,reviewThreadsin Phase 1. - Boundary markers: The skill explicitly triages comments and presents them in a structured table for user review in Phase 2.
- Capability inventory: The agent has the ability to modify source code using the
EditandWritetools and interact with external APIs via theghCLI. - Sanitization: The risk is mitigated by a mandatory human-in-the-loop workflow. Phase 4 requires "explicit user confirmation before making any edits" to the code, and Phase 8 requires "user approval before posting anything" to GitHub. This ensures the user reviews and authorizes all actions derived from untrusted input.
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) to interact with pull requests. The commands used (gh pr view,gh pr comment,gh api) are standard for GitHub automation. They are executed with static structures and do not allow arbitrary shell injection from the processed comment data.
Audit Metadata