relay-review
Pass
Audited by Gen Agent Trust Hub on May 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill demonstrates secure design principles for its intended purpose of automated code review.
- [PROMPT_INJECTION]: The skill contains internal instructions for the AI to ignore specific phrases within the data it reviews (e.g., in 'references/reviewer-prompt.md'). These are defensive boundary markers designed to mitigate indirect prompt injection from the PR descriptions and diffs being analyzed, rather than malicious attempts to bypass agent safety filters.
- [COMMAND_EXECUTION]: The skill uses several Node.js scripts to coordinate reviews, which involve executing local CLI tools such as 'gh' and 'git'. These operations are restricted to the context of the repository being reviewed and include parameter validation for safe execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (PR diffs and bodies).
- Ingestion points: External data is fetched via 'gh' CLI commands in 'SKILL.md' and processed by 'scripts/review-runner.js'.
- Boundary markers: The system uses '' tags to encapsulate external data in prompts.
- Capability inventory: The skill can execute local commands, write to specific artifact directories, and post PR comments.
- Sanitization: 'references/reviewer-prompt.md' provides explicit instructions to the AI to treat contents within boundary tags as data to evaluate, not instructions to follow, mitigating the risk of injection from the review material.
Audit Metadata