ork-review-pr
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data in the form of pull request diffs and repository code, which introduces a surface for indirect prompt injection.
- Ingestion points: The agent reads pull request diffs and branch code as described in the
SKILL.mdfile. - Boundary markers: The skill instructions do not specify any delimiters or special markers to wrap untrusted content.
- Capability inventory: The skill utilizes file-reading capabilities and queries an MCP server (
context7) for documentation and library resolution. It also references an optionalork_reviewertool. - Sanitization: No explicit sanitization or content validation for the PR diffs is mentioned.
- Mitigating Factors: The skill contains strong restrictive instructions, explicitly telling the agent to "Stay read-only" and "Do not modify files or approve/merge the PR," which limits the impact of potential instructions embedded in the reviewed code.
Audit Metadata