thermo-nuclear-pr-review
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) andgitto resolve PR information, check out branches, and fetch diffs. It also executes a local shell script (scripts/ledger) located within the skill's own directory to manage audit state. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub pull requests (diffs and source code) to perform its audit. This represents a potential surface for indirect prompt injection if an attacker embeds instructions within the code being reviewed.
- Ingestion points: Pull request metadata, diffs, and source code are read via the
ghCLI and local filesystem access. - Boundary markers: None. Content from the PR is processed without explicit delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill can execute shell commands (
gh,git), run its own local script, and read/write to the local filesystem. - Sanitization: None. The content is processed as raw text for the purpose of architectural and code quality review.
- [DATA_EXPOSURE]: The skill stores an audit "ledger" in
/tmp/claude-review-ledgers/. While this is a common practice for local state persistence, data in/tmpis generally accessible to all users on a shared Unix-like system.
Audit Metadata