load-pr-review
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh(GitHub CLI) to interact with GitHub APIs. Potential shell injection risks in thewritebackphase are mitigated by usingjqto generate JSON bodies and passing them via temporary files with the--inputflag rather than direct shell interpolation. - [PROMPT_INJECTION]: The skill processes untrusted PR review comments from external authors. It implements mitigation strategies including
[USER_CONTENT_START]/[USER_CONTENT_END]delimiters, marker escaping (replacing literal markers in user text), and explicit system instructions to the sub-agent to ignore any instructions found within the user content markers. - [REMOTE_CODE_EXECUTION]: The skill uses a local Node.js script (
scripts/load-pr-review.js) to normalize GitHub API data. It does not download or execute arbitrary remote scripts. - [DATA_EXFILTRATION]: Network operations are restricted to official GitHub API endpoints via the
ghCLI for fetching PR data and posting replies. No sensitive local data (like SSH keys or credentials) is accessed or sent externally. - [EXTERNAL_DOWNLOADS]: The skill fetches Pull Request metadata and comments from GitHub's official GraphQL and REST APIs, which are well-known services.
Audit Metadata