address-pr-feedback
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR comments and review bodies which could contain malicious instructions designed to redirect the agent's actions.
- Ingestion points: Data is gathered via the
scripts/collect_pr_feedback.pyscript which calls the GitHub API for issue comments, reviews, and threads. - Capability inventory: The agent can push code, merge PRs, and retarget branches via the GitHub CLI.
- Sanitization: The
SKILL.mdfile contains specific instructions to treat findings as proposals rather than instructions and requires the agent to build a ledger and verify all changes against the current codebase before implementation. These defensive instructions provide a strong mitigation layer. - [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) and a bundled Python script to perform its tasks. - Evidence: The script
scripts/collect_pr_feedback.pyusessubprocess.runto invoke theghtool for repository queries and API calls. - Safety check: The Python script uses safe subprocess invocation by passing arguments as a list and avoiding
shell=True. It also includes a custom quoting utility (sh_quote) for command visualization in error messages, ensuring that user-provided inputs like PR numbers or URLs are handled securely.
Audit Metadata