pr-review-expert

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PRs and GitLab MRs which could potentially be used to influence agent behavior.
  • Ingestion points: External data is fetched via gh pr view, gh pr diff, glab mr view, and glab mr diff in SKILL.md.
  • Boundary markers: The instructions do not define explicit delimiters or boundary markers to isolate external PR/MR content from the agent's instructions.
  • Capability inventory: The skill uses a wide range of powerful shell capabilities including grep, jq, curl, npm test, pytest, wc, cut, and sort.
  • Sanitization: There is no explicit sanitization logic for data extracted from PR bodies (such as ticket IDs) before they are interpolated into network commands (curl) or shell pipelines.
  • [COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary analysis functions.
  • Evidence: Extensive shell scripts are provided for file searching (grep), data parsing (jq), network requests (curl), and running test suites (npm test, pytest). While these are legitimate tools for a code review skill, they represent the capability tier used for processing untrusted data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 06:55 AM
Security Audit — agent-trust-hub — pr-review-expert