pr-review-canvas

Warn

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to interact with the environment and GitHub API.\n
  • It executes gh api calls to retrieve pull request details, file diffs, and comments.\n
  • It starts a local HTTP server using python3 -m http.server to host the generated report.\n- [DYNAMIC_EXECUTION]: The skill performs dynamic script assembly and execution.\n
  • It uses an inline Python script (python3 <<'PY' ...) to combine HTML templates, CSS, JavaScript, and PR data into a final report file.\n
  • This assembly process involves reading and writing files in the /tmp directory and performing string replacements to build the executable report.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating a surface for indirect instructions to influence the agent's review.\n
  • Ingestion points: Pull request titles, bodies, file diffs, and comments are fetched via the GitHub API and processed by the agent (file: SKILL.md).\n
  • Boundary markers: The instructions do not mandate clear delimiters or instructions for the agent to ignore potentially malicious directions embedded within the PR content.\n
  • Capability inventory: The skill has the ability to execute shell commands and write files across all its operational steps (file: SKILL.md).\n
  • Sanitization: While the skill implements HTML-safe JSON injection to prevent XSS in the browser, it lacks specific sanitization to prevent the agent itself from being influenced by instructions hidden in the PR data.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 17, 2026, 11:52 AM
Security Audit — agent-trust-hub — pr-review-canvas