thurview-pr-review
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing 'wrangler', a CLI tool from Cloudflare, to manage static asset deployments.
- [REMOTE_CODE_EXECUTION]: Executes the 'thurview' CLI tool directly from the npm registry using 'npx -y thurview'. This package is a resource provided by the skill vendor.
- [COMMAND_EXECUTION]: Extensively utilizes several CLI utilities including 'gh' (GitHub), 'glab' (GitLab), and 'wrangler' (Cloudflare) to perform authentication, repository state checks, and cloud deployments.
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially malicious content from Pull Requests and Merge Requests.
- Ingestion points: Reads git diffs, PR/MR descriptions, and comments from the forge (GitHub/GitLab) during the review flow.
- Boundary markers: Uses hidden HTML markers (e.g.,
<!-- thurview-pr-review ... -->) and specific thread identifiers to track its own contributions and state. - Capability inventory: Possesses capabilities for file system operations ('thurview scaffold'), network deployment ('thurview publish'), and interaction with forge APIs ('gh'/'glab' commands).
- Sanitization: Implements an input validation layer that enforces a 120-word budget and rejects excess prose before syncing summaries to the forge.
Audit Metadata