cookbook-review-pr
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub Pull Requests, which could contain malicious instructions designed to influence the agent's behavior or bypass checklist requirements.
- Ingestion points: Pull Request metadata, descriptions, and code diffs are fetched via
gh pr viewandgh pr diffinSKILL.md. - Boundary markers: The instructions do not define explicit delimiters or use specific prompting techniques to ensure the agent ignores instructions embedded within the untrusted PR content.
- Capability inventory: The skill uses the GitHub CLI (
gh) for data retrieval and communication, and themintCLI for document validation. It does not perform arbitrary file writes or external network requests beyond these tools. - Sanitization: There is no evidence of sanitization, filtering, or escaping of the ingested PR content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several local CLI tools to perform its task.
- Evidence: Use of
gh pr view,gh pr diff,gh pr list,gh api,mint validate,mint broken-links, andpython3 -m sglang.bench_serving. These are standard development and benchmarking tools for the SGLang ecosystem.
Audit Metadata