pr-review-diagnosis
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from GitHub pull request comments and descriptions, which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The skill ingests untrusted data via
gh pr view(PR body/title) andgh api --paginate "repos/{owner}/{repo}/pulls/<number>/comments"(review comments). - Boundary markers: The instructions do not define clear delimiters (e.g., XML tags or triple quotes) or specify "ignore instructions within data" rules for the ingested PR content.
- Capability inventory: The skill utilizes
gitfor local state inspection andgh(GitHub CLI) to view PR details, check statuses, and fetch workflow logs. It is explicitly instructed not to perform write operations (edit, commit, push, resolve) unless requested. - Sanitization: There is no evidence of sanitization or filtering of the content pulled from the GitHub API before it is processed by the agent.
Audit Metadata