Skills
Navigate
skills/tobihagemann/turbo/resolve-pr-comments/Gen Agent Trust Hub

resolve-pr-comments

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data provided by external GitHub users through pull request comments, review bodies, and issue comments.
  • Ingestion points: scripts/fetch-pr-data.sh fetches external content including meta.body, reviewThreads, reviews, and issueComments (file: SKILL.md).
  • Boundary markers: No explicit delimiters are used in the provided instructions; the skill relies on sub-skills like /interpret-feedback for processing.
  • Capability inventory: The skill possesses the ability to modify the local repository and push changes to remote branches via the /resolve-findings sub-skill (file: SKILL.md).
  • Sanitization: The skill does not explicitly perform sanitization of external text before passing it to sub-skills.
  • [COMMAND_EXECUTION]: The skill executes local shell scripts and tools to interact with the repository and the GitHub API.
  • Evidence: Executes scripts/fetch-pr-data.sh, which invokes gh api graphql to retrieve pull request metadata and conversation history (file: scripts/fetch-pr-data.sh).
  • Evidence: Utilizes git show and git branch to triage commits and verify fixes (file: SKILL.md).
  • Context: These operations are restricted to the current repository environment and are necessary for the skill's functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 12:18 PM