gh-pr-codex-review-loop
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from GitHub pull request comments and review threads.
- Ingestion points: External data enters the agent context through the
scripts/pr-review-loop.mjsscript, which fetches discussion comments and review thread bodies via GitHub GraphQL queries. - Boundary markers: No boundary markers or clear delimiters are used to separate untrusted comment content from the agent's instructions, nor are there explicit warnings to ignore instructions embedded in the comments.
- Capability inventory: The skill allows the agent to modify code, perform
git push, and executegh pr merge, which are sensitive operations that could be exploited if the agent is misled by malicious instructions inside a PR comment. - Sanitization: Raw comment text is passed directly to the agent for classification and action without any sanitization or filtering of potential injection patterns.
- [COMMAND_EXECUTION]: The skill executes multiple commands using
gh(GitHub CLI),git, and a bundlednodescript to perform PR management tasks such as viewing PR status, pushing code fixes, and merging pull requests.
Audit Metadata