resolve-ai-pr-reviews
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (GitHub PR comments) and uses that data to drive automated code modifications.
- Ingestion points: Fetches PR and issue comments in Step 2 using the
gh apitool, specifically targeting comments fromcoderabbitaiandgeminiauthors. - Boundary markers: The skill lacks explicit delimiters or instructions to the agent to disregard potentially malicious commands embedded within the fetched PR comments.
- Capability inventory: The skill allows the agent to perform file system writes ("Apply fixes" in Step 4) and execute shell-level commands via the GitHub CLI (
gh). - Sanitization: No sanitization or validation is performed on the content of the comments before they are used to influence the agent's code-writing behavior.
- [COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (
gh) to interact with the GitHub API, including fetching PR data, executing GraphQL mutations to resolve threads, and posting new comments. These commands are executed in the local shell environment.
Audit Metadata