iterate-pr
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs various shell operations using
git, the GitHub CLI (gh), and Python scripts executed viauv run. These commands are used to view PR status, commit fixes, push code, and post comments via the GitHub API.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and acting upon untrusted data from external sources. - Ingestion points: Review feedback and CI logs are fetched from GitHub PRs using
scripts/fetch_pr_feedback.pyandscripts/fetch_pr_checks.py. - Boundary markers: The instructions lack explicit delimiters or warnings to treat ingested PR comments as data rather than instructions, which may lead the agent to follow malicious commands embedded in code reviews.
- Capability inventory: The skill is granted significant capabilities, including modifying the project's source code, committing changes, pushing to remote repositories, and executing shell commands for testing and linting.
- Sanitization: There is no evidence of sanitization or filtering for the data retrieved from PR comments or CI failure snippets before they are processed by the agent.
Audit Metadata