address-pr-comments
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It ingests and interprets untrusted text from GitHub PR comments, which could be designed by an attacker to override the agent's instructions or trigger unauthorized actions. \n
- Ingestion points: GitHub pull request comment bodies are retrieved via
gh apiinSKILL.md(Step 2 and Step 4). \n - Boundary markers: Absent. The skill does not provide instructions to the agent to distinguish between the reviewer's feedback and malicious instructions embedded within the text. \n
- Capability inventory: The skill possesses the ability to read files (
SKILL.mdStep 4), modify source code (SKILL.mdStep 5), and interact with the GitHub API to post responses (SKILL.mdStep 8). \n - Sanitization: There is no evidence of sanitization or safety filtering applied to the comment content before the agent processes it. \n- [COMMAND_EXECUTION]: The skill relies extensively on the
gh(GitHub CLI) tool to perform its operations. This includes executing shell commands to fetch PR data and write responses back to the GitHub API. While these are necessary for the skill's functionality, they provide a powerful interface that an attacker could attempt to exploit through manipulated input.
Audit Metadata