pr-review-canvas
Warn
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to interact with the environment and GitHub API.\n
- It executes
gh apicalls to retrieve pull request details, file diffs, and comments.\n - It starts a local HTTP server using
python3 -m http.serverto host the generated report.\n- [DYNAMIC_EXECUTION]: The skill performs dynamic script assembly and execution.\n - It uses an inline Python script (
python3 <<'PY' ...) to combine HTML templates, CSS, JavaScript, and PR data into a final report file.\n - This assembly process involves reading and writing files in the
/tmpdirectory and performing string replacements to build the executable report.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating a surface for indirect instructions to influence the agent's review.\n - Ingestion points: Pull request titles, bodies, file diffs, and comments are fetched via the GitHub API and processed by the agent (file: SKILL.md).\n
- Boundary markers: The instructions do not mandate clear delimiters or instructions for the agent to ignore potentially malicious directions embedded within the PR content.\n
- Capability inventory: The skill has the ability to execute shell commands and write files across all its operational steps (file: SKILL.md).\n
- Sanitization: While the skill implements HTML-safe JSON injection to prevent XSS in the browser, it lacks specific sanitization to prevent the agent itself from being influenced by instructions hidden in the PR data.
Audit Metadata