pr-review-expert
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PRs and GitLab MRs which could potentially be used to influence agent behavior.
- Ingestion points: External data is fetched via
gh pr view,gh pr diff,glab mr view, andglab mr diffinSKILL.md. - Boundary markers: The instructions do not define explicit delimiters or boundary markers to isolate external PR/MR content from the agent's instructions.
- Capability inventory: The skill uses a wide range of powerful shell capabilities including
grep,jq,curl,npm test,pytest,wc,cut, andsort. - Sanitization: There is no explicit sanitization logic for data extracted from PR bodies (such as ticket IDs) before they are interpolated into network commands (
curl) or shell pipelines. - [COMMAND_EXECUTION]: The skill relies on shell command execution to perform its primary analysis functions.
- Evidence: Extensive shell scripts are provided for file searching (
grep), data parsing (jq), network requests (curl), and running test suites (npm test,pytest). While these are legitimate tools for a code review skill, they represent the capability tier used for processing untrusted data.
Audit Metadata