pr-review-canvas
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PRs, including titles, descriptions, comments, and code patches. A malicious actor could craft PR content designed to influence the agent's summary or manipulate the generated walkthrough output.
- Ingestion points: Pull request metadata, file content, and user comments retrieved via
gh apiinSKILL.md. - Boundary markers: The skill instructions do not specify the use of clear delimiters or instructions to ignore embedded commands within the fetched PR data.
- Capability inventory: The skill utilizes
gh,python3, andhttp.serverto process and present the data. - Sanitization: The skill includes strong mitigation logic in the assembly step, using Python's
json.dumpscombined with character replacement (<,>,&) to prevent Cross-Site Scripting (XSS) in the generated HTML. - [COMMAND_EXECUTION]: The skill executes multiple shell commands to perform its core functions.
- It uses the GitHub CLI (
gh) to fetch data from remote repositories. - It uses
python3for safe template assembly and to host a local web server for viewing the results. - The web server is configured to bind to
127.0.0.1, ensuring the interactive review is only accessible on the local machine.
Audit Metadata