crew-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests to perform automated reviews, which could potentially contain malicious instructions intended to influence the review engine or the agent.
- Ingestion points: The
run,queue add, andscore refetchcommands ingest PR metadata, code diffs, and.gitattributesfrom external repositories. - Boundary markers: The instructions do not specify how the agent differentiates between review rules and the potentially adversarial content within the pull request.
- Capability inventory: The tool executes shell commands, performs network operations via the
ghCLI, and writes to a local DuckDB database. - Sanitization: There is no explicit mention of sanitization or filtering of pull request content before it is interpolated into prompts for the Codex or Claude engines.
- [COMMAND_EXECUTION]: The skill relies on the execution of the
crew-code-reviewbinary and other CLI tools likeghandduckdbvia the Bash tool to perform its operations. - [DATA_EXFILTRATION]: The skill transmits repository content and PR metadata to external GitHub APIs and pluggable AI engines (Codex/Claude). While this is the intended functionality, it involves the transmission of potentially sensitive codebase information to third-party services.
Audit Metadata