code-review
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell scripts ('scripts/compare_default_branch.sh' and 'scripts/pr-context.sh') to automate Git and GitHub CLI ('gh') operations for branch comparison and PR context retrieval.
- [COMMAND_EXECUTION]: In its 'quality' mode, the skill discovers and executes 'gate recipes' from the local repository (e.g., 'npm test', 'make', 'cargo test', 'ruff'). This allows the agent to verify code quality by running project-defined scripts and tools.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from untrusted sources, including Pull Request metadata (titles, bodies, comments) and repository files (source code, 'AGENTS.md', and 'CONTRIBUTING.md'). This content could contain malicious instructions designed to alter the agent's review logic or influence its code-changing behavior.
- Ingestion points: Data enters the context via the 'gh' CLI (PR metadata) and 'view_file' (repository content and project-specific configuration files like 'AGENTS.md').
- Boundary markers: The skill does not employ explicit delimiters or system-level instructions to ignore embedded commands within the data being reviewed.
- Capability inventory: The skill possesses significant capabilities, including the execution of arbitrary shell commands found in the repository and the ability to post comments or modify state via the GitHub API.
- Sanitization: There is no explicit sanitization or filtering of the ingested content before it is processed by the underlying model.
Audit Metadata