github-pr-review-operation
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources that could contain malicious instructions intended to manipulate the agent's behavior during a code review.
- Ingestion points: The skill retrieves PR descriptions, code diffs, and comments using
gh pr view,gh pr diff, andgh apicalls as defined in SKILL.md. - Capability inventory: The agent has the ability to post comments and replies using
gh pr commentandgh apiPOST methods, providing an action path for injected instructions. - Boundary markers: The instructions lack delimiters or specific directives to separate external PR content from the agent's core instructions.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the fetched PR content before it is interpreted by the agent.
- [COMMAND_EXECUTION]: The skill utilizes shell-based tools to interact with GitHub and process data.
- Evidence: Extensive use of the GitHub CLI (
gh) for repository operations andawkfor processing diff output.
Audit Metadata