pr-feedback-classifier
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external, untrusted text (PR comments) fetched from a repository. An attacker with comment access to the PR could attempt to influence the agent's behavior during classification.\n
- Ingestion points:
erk exec get-pr-feedback(in SKILL.md) retrieves external comment data into the agent's context.\n - Boundary markers: The prompt lacks delimiters (e.g., XML tags or distinct markers) or specific "ignore embedded instructions" warnings for the comment text.\n
- Capability inventory: The agent can execute
gitanderkcommands, and has access to the PR classification logic.\n - Sanitization: No sanitization or validation of the comment content is performed before it is processed by the model.\n- [COMMAND_EXECUTION]: The skill executes
git diffand a custom CLI toolerkto retrieve repository metadata and PR feedback. These commands are utilized for their intended purpose of data retrieval within the skill's context.
Audit Metadata