agent-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub pull requests (including code diffs, metadata, and author comments) which are interpreted by AI engines (Codex and Claude) to perform actions.
- Ingestion points: External content enters the agent context through the
agent-code-review queue addandagent-code-review runcommands which fetch live PR data from remote repositories (SKILL.md). - Boundary markers: The instructions do not define explicit boundary markers or delimiters (e.g., XML tags or clear separators) to prevent the agent from mistaking instructions embedded in PR content for system-level commands.
- Capability inventory: The agent has the capability to execute GitHub actions (APPROVED, COMMENTED, REQUESTED_CHANGES), modify local configuration files (
~/.config/agent-code-review/config.json), and manipulate the underlying DuckDB database via the restrictedBashtool. - Sanitization: There is no evidence of input validation or sanitization of the PR diffs or comments before they are passed to the pluggable AI engines.
Audit Metadata