gh-review-requests
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/fetch_review_requests.pyusessubprocess.runto call the GitHub CLI (gh). The implementation correctly passes commands as a list rather than a single string, which prevents shell command injection vulnerabilities even when handling user-provided team slugs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub (PR titles and author names) and presents them to the user in a markdown table.
- Ingestion points: GitHub API responses retrieved via
gh apiinscripts/fetch_review_requests.py. - Boundary markers: The skill does not currently use explicit delimiters or "ignore instructions" warnings when rendering the PR titles.
- Capability inventory: The skill utilizes
Bashand the GitHub CLI to read data; it does not perform write operations or execute code based on the PR content. - Sanitization: PR metadata is displayed directly in a markdown table without sanitization. While this is a theoretical surface for injection, the impact is minimized by the agent's restricted scope of displaying the data.
Audit Metadata