Skills
Navigate
skills/strands-agents/harness-sdk/pr-feedback/Gen Agent Trust Hub

pr-feedback

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted pull request feedback (reviews, inline comments, and issue-level comments) and presents it to the agent for summarization and action.
  • Ingestion points: Feedback is fetched via gh api and gh pr view in fetch-pr-feedback.sh and processed in SKILL.md Step 3.
  • Boundary markers: None present; the instructions do not tell the agent to ignore instructions embedded within the PR comments.
  • Capability inventory: The skill has the capability to modify the filesystem (Step 4) and execute shell commands (Step 1 and 2).
  • Sanitization: None present; external content is processed as raw text.
  • [COMMAND_EXECUTION]: The script fetch-pr-feedback.sh takes a --repo argument which is passed directly into shell commands (gh pr view) without validation.
  • Evidence: REPO_FLAG=(--repo "$2") in fetch-pr-feedback.sh could lead to command injection if a user provides a malicious repository string containing shell metacharacters, though the risk is localized to the user's own environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 01:54 PM