git-pr-review
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from commit messages, branch names, and diff contents.\n
- Ingestion points: Data enters the context via
git log,git show, andgit diffcommands.\n - Boundary markers: Includes an 'Untrusted Input Rules' section explicitly telling the agent to treat external text as inert evidence and not instructions.\n
- Capability inventory: Shell access is restricted to standard Git read commands.\n
- Sanitization: Instructs the agent to verify commit messages against actual diff contents to detect mismatches or deception.\n- [COMMAND_EXECUTION]: The skill uses standard Git commands to gather information about code changes.\n
- The commands
git log,git diff, andgit showare used for their intended purpose of repository metadata analysis.\n- [SAFE]: Static detection of prompt injection patterns is a false positive in this context.\n - The presence of strings like 'ignore previous instructions' is part of a defensive instruction set ('Untrusted Input Rules') designed to protect the agent, not an attempt to subvert it.
Audit Metadata