pr-review
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from GitHub Pull Requests, which is a vector for indirect prompt injection.
- Ingestion points: The skill reads PR descriptions (
gh pr view --json body), code diffs (gh pr diff), and existing review comments (gh api .../comments) into the agent context. - Boundary markers: There are no explicit instructions or delimiters used to separate the untrusted PR content from the agent's instructions, increasing the risk that the agent might follow malicious commands embedded in a PR description or code.
- Capability inventory: The skill possesses write capabilities through the
gh apitool, allowing it to post comments and reviews back to the repository. - Sanitization: No specific sanitization or validation of the fetched PR content is mentioned before it is processed or used to construct subsequent shell commands.
Audit Metadata