github-pr-intelligence
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from GitHub Pull Request metadata (titles, descriptions) and diffs, which could contain adversarial instructions targeting the agent.\n
- Ingestion points: Pull request content is retrieved via the
ghCLI as instructed inSKILL.mdand implemented inscripts/review.sh.\n - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to separate PR content from the agent's core logic.\n
- Capability inventory: The agent can execute shell commands through the GitHub CLI (
gh) and access the local filesystem to analyze the repository structure.\n - Sanitization: The
scripts/review.shscript includes validation to ensure the PR number is numeric, although it does not sanitize the text content of the PR itself.
Audit Metadata