review-pr
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator for reviewing untrusted code changes, which exposes it to instructions hidden within the diffs or modified documentation files.
- Ingestion points: The skill ingests untrusted data from pull request diffs (via
git diff) and project documentation files such asREADME.md,CLAUDE.md, andconstitution.md(via file read operations) inSKILL.mdPhase 1 and Phase 2. - Boundary markers: The instructions lack clear delimiters or specific instructions for sub-agents to ignore or treat text within the reviewed code as data rather than instructions, potentially leading to sub-agents being influenced by malicious code comments or documentation updates.
- Capability inventory: The skill possesses the capability to modify repository metadata (adding PR descriptions) and interact with the GitHub API to post comments using
gh apiandmcp__github_inline_comment__create_inline_commenttools. - Sanitization: No sanitization, filtering, or validation is applied to the content of the pull request before it is processed by the Sonnet, Opus, or Haiku sub-agents.
Audit Metadata