reply-to-pr-threads
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from GitHub PR review threads, which could potentially contain malicious instructions intended to influence the agent's drafting process.
- Ingestion points: PR thread data is retrieved from the GitHub API using
gh api graphqlin Step 1. - Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore instructions embedded within the review thread text.
- Capability inventory: The skill uses the
Writetool to create local files and theghCLI to post replies via GraphQL mutations. - Sanitization: While no technical sanitization is defined, the skill mandates a human-in-the-loop review step using
AskUserQuestion(Step 4), allowing the user to inspect and approve all drafts before they are posted. - [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) to perform legitimate repository operations. - Evidence: The skill executes
gh api graphqlto query thread states and post replies as part of its primary workflow.
Audit Metadata