review-github
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The instructions command the agent to interpolate user-provided arguments directly into shell commands (e.g.,
gh pr view <N>). There is a significant risk of command injection if the input is not strictly validated as a PR identifier before shell execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull requests, including diffs and comments, which could contain malicious instructions. The skill includes mitigations such as a read-only analysis phase and a requirement for user approval before posting changes.\n - Ingestion points: Fetches PR data, diffs, and existing comments via the
ghCLI in Phase 0.\n - Boundary markers: Implements a two-phase workflow (Analyze then Post) requiring human review of the generated draft before Phase 2 executes.\n
- Capability inventory: Full access to read PR data and post/edit/delete comments using
gh api.\n - Sanitization: Uses temporary files for comment bodies in Phase 2, which helps prevent shell injection of the comment content itself.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to GitHub APIs via the
ghtool to retrieve PR information and post reviews. As GitHub is a well-known service, these operations are considered part of the skill's intended functionality.
Audit Metadata