alan-review-pr
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted content from GitHub pull requests (titles, descriptions, diffs, and comments) without specific instructions to isolate or ignore malicious instructions embedded in that data.
- Ingestion points: Data is fetched from GitHub pull requests via mcp__alan__github_get_pull_request, mcp__alan__github_get_pr_diff, and other tools as described in SKILL.md.
- Boundary markers: The instructions lack explicit boundary markers or directives for the agent to disregard instructions contained within the fetched PR content.
- Capability inventory: The agent is granted the ability to read full source files and perform significant repository actions, including merging pull requests via the mcp__alan__github_merge_pull_request tool.
- Sanitization: There is no mention of sanitizing, validating, or filtering the ingested PR content before it is analyzed by the agent.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the shell command
git remote get-url originto resolve repository metadata when it is not provided in the input.
Audit Metadata