github-pr-comments
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR comments which could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: The
scripts/pr-comments.shscript fetches raw comment bodies and diff hunks from the GitHub GraphQL API. - Boundary markers: The script provides text delimiters such as
-- code context --and-- comment --, which provide some structure but do not prevent an LLM from following instructions embedded within the comment text. - Capability inventory: The skill instructs the agent to implement changes based on these comments and subsequently run
cargo checkandcargo nextest run(viaSKILL.md). - Sanitization: There is no evidence of sanitization or filtering of the comment body text to remove potentially malicious instructions.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to execute shell commands (
bash,cargo) based on the output of remote data (PR comments). While typical for a development tool, this provides a mechanism for an indirect injection to trigger unintended code execution if the agent is tricked into modifying the build configuration or test suite.
Audit Metadata