review-github-pr
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill identifies and executes validation commands (such as linting or type-checking) specified in the repository's
CLAUDE.mdfile during Phase 1. Since the skill checkouts the Pull Request branch before running these checks, a malicious pull request could modifyCLAUDE.mdto execute arbitrary shell commands on the host machine. - [EXTERNAL_DOWNLOADS]: When invoked with a URL, the skill clones remote repositories from GitHub to the local
/tmpdirectory usinggh repo clone. While GitHub is a trusted service, this action downloads unreviewed third-party code into the local environment. - [PROMPT_INJECTION]: The skill processes untrusted input from pull request diffs, descriptions, and commit messages. It attempts to mitigate indirect prompt injection by wrapping this data in
<pr-content>tags and providing explicit instructions to sub-agents to ignore any embedded commands or instructions within those tags.
Audit Metadata