pr-human-guide
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Pull Request descriptions and diffs, which are external inputs that could contain malicious instructions.
- Ingestion points: Untrusted content is fetched using
gh pr viewandgh pr diffinreferences/commands.md. - Boundary markers: The skill wraps the untrusted PR content in
<untrusted_pr_content>tags with explicit instructions for the agent to ignore any embedded instructions (SKILL.md Step 3). - Capability inventory: The skill uses
gh pr editto update the PR description and executes a local Python helper script. - Sanitization: The skill uses a content-hashing mechanism in
marker-helper.pyto ensure that reviewer checkmarks are only preserved for byte-identical code changes, preventing a malicious PR from tricking the agent into persisting a checked state for changed content. - [COMMAND_EXECUTION]: The skill executes various CLI tools (
gh,git,jq) and a Python helper script. - The PR number argument is strictly validated against the regex
^[1-9][0-9]{0,5}$before being passed to any shell command, effectively preventing shell injection via the argument. - The skill uses temporary files and the
gh pr edit --body-fileflag to handle large, potentially dangerous strings, avoiding common shell corruption and injection issues associated with command-line arguments or environment variables.
Audit Metadata