pr-comments
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core function is to ingest and process pull request comments, which are untrusted third-party data that can be used to deliver malicious instructions to the agent.\n
- Evidence Chain:\n
- Ingestion points: The skill fetches untrusted data via
gh apifrom inline review comments (Step 2), top-level review bodies (Step 2b), and PR timeline comments (Step 2c).\n - Boundary markers: Untrusted content is wrapped in
<untrusted_comment_body>tags with explicit instructions for the agent to treat the contents as data rather than directives (references/security-model.md).\n - Capability inventory: The skill can execute shell commands, perform git commits and pushes, modify files, and create GitHub issues.\n
- Sanitization: Implements a mandatory screening pass (Step 5) based on predefined injection patterns (references/security.md), enforces a 64 KB truncation limit on ingested bodies, and utilizes a diff-context validation gate (Step 6) to prevent stale-suggestion attacks that could overwrite unrelated code.\n- [PROMPT_INJECTION]: Static analysis flags regarding instruction overrides are false positives. These phrases are present within the skill's security documentation (references/security.md) as specific patterns for the agent to detect and mitigate in external comments.\n- [COMMAND_EXECUTION]: The skill uses well-known and standard CLI tools (
git,jq,gh) to perform its documented PR management tasks. All shell interpolations are double-quoted to prevent command injection.
Audit Metadata