snap-review
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of untrusted external content.
- Ingestion points: Processes data from GitHub PR bodies, comments, and linked issues fetched via
gh pr viewand link recursion (Workflow Step 1 inSKILL.md). - Boundary markers: The instructions do not define delimiters or provide warnings to ignore embedded instructions within the ingested text.
- Capability inventory: The agent can post review comments to GitHub and execute "read-only validation commands" (Workflow Step 2 in
SKILL.md). - Sanitization: No sanitization or validation logic is defined for external data before it is interpreted by the agent.
- [COMMAND_EXECUTION]: The workflow allows the agent to execute shell commands ("read-only validation commands") to verify code behavior. While intended to be non-destructive, this execution environment provides a vector for exploitation if the agent's instructions are overridden by malicious content in a PR.
Audit Metadata