github-review-suggestions
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub Pull Requests, which is a vector for indirect prompt injection where malicious instructions could be embedded in code or comments.
- Ingestion points: Untrusted data enters the agent context via the
gh pr viewandgh pr diffcommands described inSKILL.md. - Boundary markers: The skill includes a contract in
SKILL.mdthat explicitly instructs the agent to treat PR metadata and diffs as untrusted third-party text and to never follow instructions embedded within them. - Capability inventory: The skill has the authority to post review comments back to GitHub via the
gh apiand execute shell commands usinggit,gh, andnode. - Sanitization: The workflow mandates human approval before any comments are posted or branches are modified, and it instructs the agent to redact secrets from suggested fixes.
Audit Metadata