sentry-pr-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard shell commands (
ghCLI andjq) to interact with the GitHub API. This is the primary method for fetching project data and is used in a transparent, non-obfuscated manner. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to parse and potentially follow instructions contained within GitHub PR comments.
- Ingestion points: PR comment data is ingested via
gh apicalls inSKILL.md. - Boundary markers: The skill relies on specific Markdown headers (e.g.,
AI Prompt) to identify instructions but does not implement robust boundary markers or 'ignore' instructions for the agent. - Capability inventory: The instructions require the agent to review and "Implement fix" in the codebase, which necessitates file-write permissions.
- Sanitization: The skill performs direct parsing of the comment body without apparent sanitization of the extracted prompt content.
- Mitigation: A security control is implemented via a strict filter (
.user.login == "seer-by-sentry[bot]") to ensure that only comments authored by the verified Sentry bot are processed, preventing unauthorized users from injecting instructions through PR comments.
Audit Metadata