github-code-review
Warn
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill attempts to retrieve the
GITHUB_TOKENfrom sensitive locations, including the user's~/.git-credentialsfile and local environment files (.env). While functional for GitHub API interaction, these files contain sensitive authentication data. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external GitHub Pull Requests, creating a vulnerability surface where malicious content in a PR could influence agent behavior.
- Ingestion points: Retrieves PR metadata (title, body) and file contents through the GitHub REST API and
git fetchoperations (SKILL.md). - Boundary markers: The skill lacks explicit delimiters or instructions to ignore potential commands embedded within the reviewed PR content.
- Capability inventory: The skill uses powerful tools including
git,gh,curl, and suggests running local test suites likepytestornpm teston the checked-out PR code (SKILL.md). - Sanitization: No input validation or sanitization of PR content is performed before it is processed by the agent.
- [COMMAND_EXECUTION]: Utilizes shell scripts to parse system files and manage repository workflows, including checking out external PR branches.
- [EXTERNAL_DOWNLOADS]: Downloads PR metadata and repository content from GitHub's official infrastructure to facilitate the review process.
Audit Metadata