review-pr

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator for reviewing untrusted code changes, which exposes it to instructions hidden within the diffs or modified documentation files.
  • Ingestion points: The skill ingests untrusted data from pull request diffs (via git diff) and project documentation files such as README.md, CLAUDE.md, and constitution.md (via file read operations) in SKILL.md Phase 1 and Phase 2.
  • Boundary markers: The instructions lack clear delimiters or specific instructions for sub-agents to ignore or treat text within the reviewed code as data rather than instructions, potentially leading to sub-agents being influenced by malicious code comments or documentation updates.
  • Capability inventory: The skill possesses the capability to modify repository metadata (adding PR descriptions) and interact with the GitHub API to post comments using gh api and mcp__github_inline_comment__create_inline_comment tools.
  • Sanitization: No sanitization, filtering, or validation is applied to the content of the pull request before it is processed by the Sonnet, Opus, or Haiku sub-agents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 01:10 AM
Security Audit — agent-trust-hub — review-pr