vp-pr-review-followup
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, specifically GitHub Pull Request threads and code repositories.
- Ingestion points: As described in
references/workflow.md, the skill fetches the original thread, subsequent replies, and the current code or diff. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands to isolate the untrusted PR content from the agent's core instructions.
- Capability inventory: The skill's actions are limited to reading data and posting replies or resolving threads; it explicitly restricts writing to the PR branch in
SKILL.md. - Sanitization: There is no evidence of filtering or sanitizing the fetched PR data before it is processed by the agent.
Audit Metadata