code-review-playbook
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub pull requests, including titles, descriptions, comments, and code diffs. This creates a surface where an attacker could embed malicious instructions in a PR to influence the agent's behavior during review. Ingestion points occur in 'scripts/review-pr.md' and 'scripts/run-pr-checks.py' via 'gh' commands. No boundary markers or sanitization are present to mitigate this risk. The agent's access to 'WebFetch' and 'Bash' tools increases the potential impact of such an injection.
- [DYNAMIC_CONTEXT_INJECTION]: The 'scripts/review-pr.md' file employs the '!' syntax to execute shell commands at load time, specifically 'gh pr list' to fetch recent pull requests. This provides automated context retrieval from the local environment.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to execute developer tools such as the GitHub CLI ('gh'), 'ruff', 'eslint', and 'biome' for code analysis and metadata retrieval.
Audit Metadata