review-pr
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and acts upon PR comments from external contributors to drive actions like code modification.
- Ingestion points: PR comment bodies are fetched from the GitHub API using
gh apiin Step 2. - Boundary markers: The instructions lack boundary markers or explicit guidelines to treat the comment text as data rather than instructions, making it possible for a comment to hijack the agent's flow.
- Capability inventory: The agent has permissions to read files, write code changes (the 'Fix' category), and execute GitHub/Git CLI commands.
- Sanitization: No validation or sanitization is performed on the comment content before the agent evaluates it for potential implementation.
- [COMMAND_EXECUTION]: The skill defines a fully automated workflow that explicitly bypasses user confirmation for code modifications and repository actions. The instructions 'Single-pass flow' and 'Don't pause for user confirmation' remove the safeguard of human review, which significantly increases the risk that malicious input in a PR comment could result in the automatic execution of harmful repository changes or CLI commands.
Audit Metadata