reply-to-pr-conversation
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub PR comments to draft replies, creating a potential surface for indirect prompt injection. * Ingestion points: Processes PR issue-comment lists from the conversation context (SKILL.md, Step 2). * Boundary markers: The skill uses blockquotes to delimit quotes but lacks explicit instructions to ignore potentially malicious instructions embedded in the input comments. * Capability inventory: Has file-writing capabilities via the Write tool and network-posting capabilities via the gh api command. * Sanitization: Implements selective quoting and replaces code blocks with placeholders to prevent nesting issues.
- [COMMAND_EXECUTION]: The skill uses the gh api command-line tool to post comments to GitHub (SKILL.md, Step 4). This is a standard operation for interacting with the platform.
- [DATA_EXFILTRATION]: The skill transmits the drafted comment to the GitHub API. This operation targets a well-known service and is restricted to the repository context as intended by the skill's purpose.
Audit Metadata