community-pr-batch-review
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests (PRs), which may contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Pull request metadata, source code diffs, build workflow files, and documentation from external contributors.
- Boundary markers: The skill explicitly contains instructions to treat "contributor-controlled instructions" as "review material" rather than authoritative commands, which helps mitigate accidental obedience to embedded instructions.
- Capability inventory: The skill allows for the execution of code, build processes, and tests. It also coordinates between an orchestrator and worker agents.
- Sanitization: The instructions mandate the use of isolated environments and the inspection of workflow changes before execution. It explicitly forbids the use of host credentials or shared writable state when running fork code.
- [PROMPT_INJECTION]: The skill contains directives that establish a hierarchy of instructions, which can be used to override parts of the skill's own logic.
- Evidence: The skill states that "current user instructions and trusted base-branch AGENTS.md take precedence over stale skill details." While this is intended as a safety and consistency measure to ensure the agent follows the most up-to-date system guidance, it acts as an instruction-override marker.
Audit Metadata