review-pr
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests, including code diffs, branch names, and community comments. This creates a surface for indirect prompt injection, where an attacker might attempt to influence the agent's behavior by embedding instructions in the code or PR conversation.
- Ingestion points: Untrusted data enters the context via
gh pr diffandgh apicalls for reviews and comments, as well as linked issue content (detailed inSKILL.mdandreferences/review-workflow.md). - Boundary markers: While the skill follows a rigid workflow to analyze findings, it does not explicitly instruct the agent to treat diff contents as potentially adversarial or to use specific delimiters when processing it.
- Capability inventory: The skill possesses write capabilities, such as posting comments and submitting formal reviews to GitHub using the
ghCLI (documented inreferences/gh-cli-reference.md). - Sanitization: The instructions do not specify sanitization or escaping of external content before interpolation into the agent's reasoning process.
Audit Metadata